PT-2026-30001 · Electron · Electron

Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-34771

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8

Description Applications using an asynchronous session.setPermissionRequestHandler() may experience a use-after-free issue when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback can dereference freed memory, potentially leading to a crash or memory corruption. Applications not using a permission request handler, or those responding synchronously, are not affected.

Recommendations Versions prior to 38.8.6: Update to version 38.8.6 or later. Versions prior to 39.8.0: Update to version 39.8.0 or later. Versions prior to 40.7.0: Update to version 40.7.0 or later. Versions prior to 41.0.0-beta.8: Update to version 41.0.0-beta.8 or later. As a workaround, respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-34771

GHSA-8337-3P73-46F4

Affected Products

Electron

References · 7

• https://github.com/electron/electron/security/advisories/GHSA-8337-3p73-46f4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8337-3p73-46f4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34771 · Security Note
• https://github.com/electron/electron · Note
• https://twitter.com/infoflowcloud/status/2040482524963512354 · Twitter Post
• https://twitter.com/CVEnew/status/2040481269285552352 · Twitter Post
• https://twitter.com/SeedVEVO/status/2039982997689286963 · Twitter Post