npm / electron

Unpreventable top-level navigation

Modified: 3/13/2026

Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Modified: 4/6/2026

Renderers can obtain access to random bluetooth device without permission in Electron

Modified: 11/8/2023

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

Modified: 4/6/2026

Chromium Remote Code Execution in electron

Modified: 11/8/2023

Electron: Use-after-free in offscreen child window paint callback

Modified: 4/6/2026

Context isolation bypass in Electron

Modified: 3/13/2026

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Modified: 4/6/2026

Electron vulnerable to URL spoofing via PDFium

Modified: 11/8/2023

Electron vulnerable to Heap Buffer Overflow in NativeImage

Modified: 7/1/2025

Context isolation bypass via Promise in Electron

Modified: 3/13/2026

AutoUpdater module fails to validate certain nested components of the bundle

Modified: 11/8/2023

Electron vulnerable to remote command execution

Modified: 11/8/2023

ASAR Integrity bypass via filetype confusion in electron

Modified: 9/18/2024

Electron vulnerable to out-of-package code execution when launched with arbitrary cwd

Modified: 11/8/2023

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Modified: 4/6/2026

Electron: Use-after-free in offscreen shared texture release() callback

Modified: 4/6/2026

Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration

Modified: 11/8/2023

Electron: USB device selection not validated against filtered device list

Modified: 4/6/2026

Heap buffer overflow in GPU

Modified: 11/8/2023

Electron: Use-after-free in download save dialog callback

Modified: 4/6/2026

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Modified: 4/6/2026

Electron: Crash in clipboard.readImage() on malformed clipboard image data

Modified: 4/8/2026

Electron: Named window.open targets not scoped to the opener's browsing context

Modified: 4/8/2026

Arbitrary file read via window-open IPC in Electron

Modified: 3/13/2026

Electron protocol handler browser vulnerable to Command Injection

Modified: 11/8/2023

libwebp: OOB write in BuildHuffmanTable

Modified: 2/4/2026

High severity vulnerability that affects electron

Modified: 11/8/2023

Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled

Modified: 11/8/2023

Context isolation bypass via contextBridge in Electron

Modified: 3/13/2026

Electron webPreferences vulnerability can be used to perform remote code execution

Modified: 11/8/2023

IPC messages delivered to the wrong frame in Electron

Modified: 3/13/2026

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

Modified: 4/6/2026

Electron: Unquoted executable path in app.setLoginItemSettings on Windows

Modified: 4/6/2026

Electron: Use-after-free in PowerMonitor on Windows and macOS

Modified: 4/6/2026

Context isolation bypass via leaked cross-context objects in Electron

Modified: 3/13/2026

Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API

Modified: 3/13/2026

Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled

Modified: 11/8/2023

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Modified: 4/6/2026

Exfiltration of hashed SMB credentials on Windows via file:// redirect

Modified: 11/8/2023

Electron context isolation bypass via nested unserializable return value

Modified: 11/8/2023

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

Modified: 6/15/2026

Electron affected by libvpx's heap buffer overflow in vp8 encoding

Modified: 2/15/2024

Electron: Incorrect origin passed to permission request handler for iframe requests

Modified: 4/6/2026

Electron has ASAR Integrity Bypass via resource modification

Modified: 9/5/2025

Remote Code Execution in electron

Modified: 11/8/2023

Electron: Service worker can spoof executeJavaScript IPC replies

Modified: 4/6/2026

electron ASAR Integrity bypass by just modifying the content

Modified: 7/1/2025

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Modified: 4/6/2026