~ / search / GHSA-qmv3-fv6v-rmhq

GHSA-qmv3-fv6v-rmhq

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Source: GitHub Advisory Database (reviewed) High CVE-2026-102677

Packages

EcosystemPackageAffectedFixed in
npm electron >= 42.3.3, < 42.10.0 42.10.0
npm electron >= 43.0.0-beta.1, < 43.5.0 43.5.0
npm electron >= 44.0.0-alpha.1, < 44.0.0-beta.6 44.0.0-beta.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load. Apps are only affected if they load untrusted content. Apps that do not load untrusted content are not affected. ### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ### Fixed Versions * `44.0.0-beta.6` * `43.5.0 ` * `42.10.0` ### For more information If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.