PT-2026-30001 · Npm · Electron

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-34771

OSV

CVSS v3.1

7.5

High

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Impact

Apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected.

Workarounds

Respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

Fixed Versions

• 41.0.0-beta.8
• 40.7.0
• 39.8.0
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email [e-mail]

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-34771

GHSA-8337-3P73-46F4

Affected Products

Electron

References · 3

• https://osv.dev/vulnerability/GHSA-8337-3p73-46f4 · Vendor Advisory
• https://github.com/electron/electron · Note
• https://github.com/electron/electron/security/advisories/GHSA-8337-3p73-46f4 · Note