PT-2026-30002 · Electron · Electron

Vertedinde · Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-34772

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, prior to 39.8.0, prior to 40.7.0, and prior to 41.0.0-beta.8

Description Electron applications allowing downloads and programmatic session destruction may experience a use-after-free condition. Specifically, if a session is terminated while a native save-file dialog is open during a download, dismissing the dialog can lead to dereferencing freed memory, potentially causing a crash or memory corruption. Applications that do not destroy sessions or permit downloads are not affected.

Recommendations Update to Electron version 38.8.6 or later. Update to Electron version 39.8.0 or later. Update to Electron version 40.7.0 or later. Update to Electron version 41.0.0-beta.8 or later. Avoid destroying sessions while a download save dialog may be open. Cancel pending downloads before session teardown.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-34772

GHSA-9W97-2464-8783

Affected Products

Electron

References · 6

• https://github.com/electron/electron/security/advisories/GHSA-9w97-2464-8783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34772 · Security Note
• https://osv.dev/vulnerability/GHSA-9w97-2464-8783 · Vendor Advisory
• https://github.com/electron/electron · Note
• https://twitter.com/CVEnew/status/2040481267549192260 · Twitter Post
• https://twitter.com/infoflowcloud/status/2040482439122899339 · Twitter Post