PT-2025-35936 · Electron · Electron

Dariushoule · Published 2025-08-19 · Updated 2026-02-13 · CVE-2025-55305

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Electron versions prior to 35.7.5 Electron versions 36.0.0-alpha.1 through 36.8.0 Electron versions 37.0.0-alpha.1 through 37.3.1 Electron versions 38.0.0-alpha.1 through 38.0.0-beta.6

Description Electron is a framework used for building cross-platform desktop applications with JavaScript, HTML, and CSS. A flaw exists where the ASAR integrity checks can be bypassed through resource modification. This issue impacts applications that have both the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. The vulnerability allows for subverting code integrity checks, potentially enabling local backdoors in applications like Signal, 1Password, and Slack. The issue exploits flaws in V8 heap snapshots, allowing unsigned JavaScript code to execute.

Recommendations Electron versions prior to 35.7.5: Update to version 35.7.5 or later. Electron versions 36.0.0-alpha.1 through 36.8.0: Update to version 36.8.1 or later. Electron versions 37.0.0-alpha.1 through 37.3.1: Update to version 37.3.1 or later. Electron versions 38.0.0-alpha.1 through 38.0.0-beta.6: Update to version 38.0.0-beta.6 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-829

Related Identifiers

BDU:2025-12971

CVE-2025-55305

GHSA-VMQV-HX8Q-J7MG

Affected Products

Electron

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55305.json · Exploit
• https://bdu.fstec.ru/vul/2025-12971 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55305 · Security Note
• https://osv.dev/vulnerability/GHSA-vmqv-hx8q-j7mg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55305 · Vendor Advisory
• https://github.com/electron/electron · Note
• https://github.com/electron/electron/pull/48102 · Note
• https://github.com/electron/electron/pull/48101 · Note
• https://github.com/electron/electron/security/advisories/GHSA-vmqv-hx8q-j7mg · Note
• https://github.com/electron/electron/pull/48104 · Note
• https://github.com/electron/electron/commit/23a02934510fcf951428e14573d9b2d2a3c4f28b · Note
• https://github.com/electron/electron/pull/48103 · Note
• https://github.com/electron/electron/commit/fdf29ce83870109d403f5c23ae529dbd0e8f4fee · Note
• https://github.com/electron/electron/commit/3f92511cdecc39f46b0e86cce40a0c691e301c9d · Note
• https://github.com/electron/electron/commit/2e5a0b7220ebf955c6785cc5adb2e2b1cf77dac1 · Note