CVE-2026-34771

This vulnerability stems from a use-after-free condition (CWE-416) in the Electron framework's permission request handling mechanism. Electron is a framework for building cross-platform desktop applications with web technologies (JavaScript, HTML, CSS). The flaw occurs specifically in the asynchronous callback architecture for session.setPermissionRequestHandler(), which processes permission requests for browser features like fullscreen mode, pointer lock, and keyboard lock. When an application registers an asynchronous permission handler, Electron stores a callback reference to invoke once the permission decision is made. However, if the DOM frame that initiated the request navigates away or the window closes before the callback executes, the stored callback attempts to dereference memory that has already been freed by the frame/window cleanup process. This classic use-after-free condition can lead to memory corruption, potentially allowing an attacker to manipulate memory contents or cause application crashes. The vulnerability only manifests when developers implement asynchronous permission handlers; synchronous handlers execute immediately and avoid this lifecycle timing issue.