~ / search / GHSA-98mx-cjp9-gchm

GHSA-98mx-cjp9-gchm

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Source: GitHub Advisory Database (reviewed) Low CVE-2026-113797

Packages

EcosystemPackageAffectedFixed in
npm electron >= 45.0.0-alpha.1, < 45.0.0-alpha.4 45.0.0-alpha.4
npm electron >= 44.0.0-alpha.1, < 44.1.1 44.1.1
npm electron >= 43.0.0-alpha.1, < 43.5.1 43.5.1
npm electron < 42.11.1 42.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact `chrome.tabs.query()` returned each tab's `url` and `title` to extensions that held neither the `tabs` permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session. Apps are only affected if they load extensions (`session.extensions.loadExtension`) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected. ### Workarounds Do not load untrusted or unvalidated extensions. In general you should only load trusted extensions. ### Fixed Versions * `45.0.0-alpha.4` * `44.1.1` * `43.5.1` * `42.11.1` ### For more information If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.