PT-2026-30008 · Npm · Electron

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-34778

OSV

CVSS v3.1

5.9

Medium

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Impact

A service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions.

Workarounds

Do not trust the return value of webContents.executeJavaScript() for security decisions. Use dedicated, validated IPC channels for security-relevant communication with renderers.

Fixed Versions

• 41.0.0
• 40.8.1
• 39.8.1
• 38.8.6

For more information

If there are any questions or comments about this advisory, please email [e-mail]

Fix

Insufficient Verification of Data Authenticity

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-345

CWE-290

Related Identifiers

CVE-2026-34778

GHSA-XJ5X-M3F3-5X3H

Affected Products

Electron

References · 3

• https://osv.dev/vulnerability/GHSA-xj5x-m3f3-5x3h · Vendor Advisory
• https://github.com/electron/electron · Note
• https://github.com/electron/electron/security/advisories/GHSA-xj5x-m3f3-5x3h · Note