CVE-2026-34778

The CVSS score of 5.9 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N indicates this requires network access but with high attack complexity and low privileges (PR:L), yet results in high integrity impact. The high integrity (I:H) component is the primary concern-an attacker can manipulate security-sensitive decisions. However, real-world risk is substantially lower than the CVSS suggests because exploitation requires three preconditions: (1) the application must register a service worker, (2) the attacker must control or inject malicious code into that service worker, and (3) the application must rely on executeJavaScript() return values for security decisions. The absence of public exploit code and lack of CISA KEV listing indicate this is not actively exploited in the wild, though the flaw is structural and would be trivial to exploit if conditions are met. This is a high-integrity, low-automation issue most relevant to developers using deprecated or insecure patterns; modern applications using dedicated IPC channels are naturally resistant.

An attacker with the ability to inject or control a service worker within an Electron application (e.g., via a supply-chain compromise, malicious dependency, or XSS vulnerability in the renderer) could craft a spoofed IPC reply that causes webContents.executeJavaScript() to resolve with fabricated authentication tokens, permission flags, or other sensitive data. The main process, trusting this return value, would make security decisions based on the attacker's injected data rather than legitimate execution results. High attack complexity (AC:H) reflects the requirement to control the service worker context; however, once that condition is met, the exploit is deterministic and requires no additional user interaction (UI:N). No public proof-of-concept has been disclosed, and this is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.