PT-2026-30004 · Electron · Electron

Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-34774

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.1, 40.7.0, and 41.0.0

Description Electron applications utilizing offscreen rendering and allowing child windows through window.open() may experience a use-after-free condition. Specifically, if a parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child window can dereference freed memory, potentially leading to a crash or memory corruption. Applications are only susceptible if they employ offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler allows the creation of child windows.

Recommendations Versions prior to 39.8.1: Update to version 39.8.1 or later. Versions prior to 40.7.0: Update to version 40.7.0 or later. Versions prior to 41.0.0: Update to version 41.0.0 or later. As a workaround, deny child window creation from offscreen renderers in your setWindowOpenHandler, or ensure child windows are closed before the parent is destroyed.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-34774

GHSA-532V-XPQ5-8H95

Affected Products

Electron

References · 8

• https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34774 · Security Note
• https://osv.dev/vulnerability/GHSA-532v-xpq5-8h95 · Vendor Advisory
• https://github.com/electron/electron · Note
• https://twitter.com/SeedVEVO/status/2039982997689286963 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040251764625359084 · Twitter Post
• https://twitter.com/infoflowcloud/status/2040482471133745253 · Twitter Post
• https://twitter.com/CVEnew/status/2040481265418490113 · Twitter Post