CVE-2026-34767

This vulnerability presents moderate real-world risk despite a moderate CVSS score of 5.9. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N) indicates network attack vector, high complexity (requiring specific application configuration and user interaction), no privileges required, and high integrity impact with low confidentiality impact. The high complexity rating reflects that only applications explicitly using custom protocol handlers or webRequest header modification are vulnerable; applications not reflecting external input into headers are unaffected. The high integrity impact is meaningful-attackers can inject HSTS headers to force HTTPS downgrade, modify Set-Cookie headers to hijack sessions, or inject CSP directives to exfiltrate data. The required user interaction and high attack complexity reduce the likelihood of mass exploitation. Patch availability across four maintained release branches (38, 39, 40, 41) indicates vendor responsiveness. This is a real priority for Electron application developers who use these specific APIs with untrusted input, but not a critical emergency for applications following input validation best practices.

An attacker targets a Desktop application built with vulnerable Electron that registers a custom protocol handler (e.g., 'myapp://') and accepts query parameters that are reflected into response headers without validation. The attacker sends the victim a link like 'myapp://callback?token=value%0dSet-Cookie:%20admin=true'. When the application processes this and reflects the token parameter into a response header without sanitization, the injected newlines cause the application to send an additional Set-Cookie header, allowing session hijacking. User interaction is required-the victim must click the link or the application must automatically process attacker-controlled URLs.