CVE-2026-34772

CVSS 5.8 (Medium) with local attack vector, high complexity, and user interaction requirement reflects realistic constraints: an attacker cannot trigger this remotely and must trick a user into dismissing a save dialog during a specific race condition window. EPSS data not provided, but the combination of high complexity (AC:H) and mandatory user interaction (UI:R) significantly reduces practical exploitability despite the confidentiality impact (C:H). SSVC framework analysis: exploitation is unconfirmed (no KEV status, no public POC), technical impact is partial (memory corruption may cause denial of service or limited information disclosure but requires specific timing). The workaround-canceling downloads before session destruction-is implementable for most applications, further lowering real-world risk. This is a legitimate medium-severity issue relevant to Electron application developers rather than an across-the-board critical risk.

An attacker cannot remotely trigger this vulnerability due to its local-only attack vector. Instead, a developer or user must be tricked into a specific scenario: an Electron application initiates a file download (presenting the native save dialog), and concurrently the application or an attacker with local code execution triggers session destruction. When the user dismisses the save dialog, the dialog callback attempts to access freed session memory, potentially crashing the application or corrupting its memory state. This requires precise timing and user interaction, making it impractical for widespread exploitation but relevant for denial-of-service attacks against specific Electron applications.