CyberSecBulletin
CVE-2026-34765NVD status: Analyzed

electron: Exposure of Resource to Wrong Sphere

Published Updated By the CyberSecBulletin desk

CVE-2026-34765 is a high-severity exposure of resource to wrong sphere vulnerability in electron, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected electron versions: < 39.8.5; >= 40.0.0-alpha.1, < 40.8.5; >= 41.0.0-alpha.1, < 41.1.0, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.3% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of electron you run against the affected versions below, and install the vendor's latest release.
  2. Read the advisory on github.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
Electronelectron< 39.8.5; >= 40.0.0-alpha.1, < 40.8.5; >= 41.0.0-alpha.1, < 41.1.0; >= 42.0.0-alpha.1, < 42.0.0-alpha.5Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.16.0MediumCNA (github.com)
CVSS 3.18.8HighNVD

Official description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

More Exposure of Resource to Wrong Sphere vulnerabilities (CWE-668)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in electron

All electron vulnerabilities

Recent Exposure of Resource to Wrong Sphere vulnerabilities

Spotted an error? Tell us.