CVE-2026-34769

Electron application must construct webPreferences by spreading untrusted configuration objects without an allowlist. Attacker needs local access and victim interaction (e.g., opening crafted config file). Fixed hardcoded webPreferences are not affected.

Real-world risk is moderate despite the 7.8 CVSS score due to several limiting factors. Attack vector is local (AV:L) requiring the attacker to influence application configuration files or environment variables read at startup, and attack complexity is high (AC:H) because exploitation depends on specific insecure coding patterns where developers spread untrusted objects into webPreferences without allowlisting. User interaction (UI:R) is required as the victim must launch the vulnerable application with attacker-controlled configuration. No EPSS score provided, and no confirmed active exploitation (not in CISA KEV). The vulnerability affects a subset of Electron applications-only those dynamically constructing webPreferences from external sources without input validation. Well-architected Electron apps using hardcoded, static webPreferences objects remain unaffected. However, the scope change and potential for complete sandbox bypass (C:H/I:H/A:H) means successful exploitation grants attackers significant control, potentially enabling arbitrary code execution with the user's privileges. Priority should focus on applications known to load external configuration files or accept user-customizable settings that feed into BrowserWindow creation. The publicly available GitHub advisory provides technical details that could facilitate proof-of-concept development.

An attacker identifies an Electron-based desktop application that loads user preferences from a JSON configuration file in the user's home directory and spreads that configuration into webPreferences during BrowserWindow creation. The attacker modifies the config file to inject {"commandLineSwitches": ["--no-sandbox", "--disable-web-security"]} and socially engineers the victim to restart the application. Upon launch, the Electron renderer process starts with sandboxing disabled and web security controls bypassed. The attacker then serves malicious content through a compromised website or man-in-the-middle attack, exploiting the disabled same-origin policy to access local files, execute arbitrary Node.js code if nodeIntegration becomes accessible, and potentially achieve persistent code execution with the user's privileges. Attack complexity is high because the attacker must both control the configuration source and convince the user to launch the application, but successful exploitation completely compromises the application's security boundary.