Multiple security vulnerabilities have been identified in Electron, affecting permission attribution, GPU frame validation, extension tab metadata, and cookie handling in several release lines, including 42.x, 43.x, 44.x, and 45.x alpha releases. The issues can allow untrusted content or a compromised GPU process to bypass intended controls, disclose memory, or make credentialed requests. Overall risk is moderate, with the greatest impact for applications that load untrusted content, embed iframes, load extensions, or use offscreen rendering and frame capture.
CVE-2026-114121 (CVSS 5.4 — Medium): Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requesting URL passed to the permission handler could be a trusted origin for a launch requested by untrusted content. An origin-based handler could therefore let untrusted content launch an OS-registered external application.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Electron, affecting permission attribution, GPU frame validation, extension tab metadata, and cookie handling in several release lines, including 42.x, 43.x, 44.x, and 45.x alpha releases. The issues can allow untrusted content or a compromised GPU process to bypass intended controls, disclose memory, or make credentialed requests. Overall risk is moderate, with the greatest impact for applications that load untrusted content, embed iframes, load extensions, or use offscreen rendering and frame capture.
CVE-2026-114121 (CVSS 5.4 — Medium): Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requesting URL passed to the permission handler could be a trusted origin for a launch requested by untrusted content. An origin-based handler could therefore let untrusted content launch an OS-registered external application.[emaillocker id="1283"]
CVE-2026-114124 (CVSS 3.9 — Low): In offscreen rendering on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause out-of-bounds memory reads while producing paint event images, disclosing memory or crashing the app.
CVE-2026-114122 (CVSS 3.9 — Low): Frame data received from the GPU process for frame subscription was not fully validated by the main process. A compromised GPU process could cause out-of-bounds memory reads while producing captured frame images, disclosing memory or crashing the app.
CVE-2026-113797 (CVSS 3.1 — Low): Extension tab queries returned tab URLs and titles to extensions that did not hold the required tabs permission or matching host permissions. Any loaded extension could read the URL and title of all web content in its session.
CVE-2026-113798 (CVSS 5.4 — Medium): Pointer lock permission requests from some cross-origin iframes were attributed to the top-level frame rather than the requesting frame. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.
CVE-2026-113796 (CVSS 4.2 — Medium): Pages opened into a new window from a link were treated as same-site rather than as cross-site requests from the initiating page. Untrusted content could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a cross-site request forgery defence.
These vulnerabilities collectively present a moderate risk to Electron-based applications that expose untrusted content, embedded frames, extensions, or GPU frame capture paths. The most at risk are apps that rely on origin-based permission decisions or load content without strict isolation. Developers should review their Electron configurations and limit the capabilities of untrusted content.
We recommend you to update Electron to version 42.11.9, 43.7.6, 44.5.0, or 45.0.0-alpha.13 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]