Microsoft CVE-2026-34774

Requires Electron application with offscreen rendering enabled (webPreferences.offscreen: true) and setWindowOpenHandler configured to permit child windows via window.open(). Attacker must trigger parent WebContents destruction while child window remains open. No user interaction required for exploitation.

The CVSS v3.1 score of 8.1 (High) reflects the severe potential impact (code execution, memory corruption) but is tempered by high attack complexity (AC:H). The vulnerability requires the confluence of specific application configuration choices: offscreen rendering enabled, child windows permitted, precise timing of parent destruction while child remains open, and the child window actively painting. The attack vector is network-based (AV:N) and requires no authentication (PR:N) or user interaction (UI:N), which elevates theoretical risk. However, real-world exploitability is constrained by the AC:H rating-attackers must identify vulnerable Electron applications with this specific configuration pattern and trigger the precise destruction/paint timing. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not currently being exploited in the wild. The SSVC framework would likely classify this as medium priority: exploitation status is none, automatable is no (requires specific app configuration discovery), technical impact is total (memory corruption/code execution). The primary risk is to developers who built Electron applications with offscreen rendering enabled for specialized use cases like server-side rendering, automated testing, or headless browser functionality. Most standard Electron desktop applications do not use offscreen rendering, significantly limiting the vulnerable population. Organizations should prioritize patching if they deploy custom Electron applications, but the narrow configuration requirement reduces urgency compared to broadly exploitable vulnerabilities.

An attacker identifies a web application built with vulnerable Electron that uses offscreen rendering for server-side page generation or automated testing and permits user-initiated window.open() calls. The attacker crafts a malicious web page that, when loaded in the offscreen renderer, opens a child window via window.open() and then triggers destruction of the parent WebContents through application-specific actions (such as navigating away, closing a session, or triggering a cleanup routine). While the child window remains open and continues paint operations, it dereferences the freed parent memory. By controlling the timing and content of subsequent paint frames, the attacker could potentially corrupt memory to hijack control flow and achieve arbitrary code execution within the Electron application's process space, bypassing normal browser sandboxing. No public exploit code exists, and successful exploitation requires deep knowledge of Electron internals, precise timing control, and heap layout manipulation techniques.