Node.js CVE-2026-34780

Electron applications using contextBridge to expose VideoFrame objects from WebCodecs API to the main world. Attacker requires ability to execute JavaScript in main world (e.g., via XSS). Victim must trigger XSS payload. Only affects apps that bridge VideoFrame objects; default configurations unaffected.

Real-world risk is moderate-to-high with important caveats. The CVSS 8.4 score reflects severe potential impact (confidentiality, integrity, and availability all High with scope change), but attack complexity is High (AC:H) requiring specific preconditions: the application must bridge VideoFrame objects via contextBridge AND the attacker must achieve XSS in the main world. The UI:R (user interaction required) and PR:N (no privileges) indicate a realistic browser-based attack chain. EPSS data not provided, but GitHub Security Advisory publication increases attacker awareness. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the detailed vendor advisory provides sufficient information for exploit development. SSVC factors suggest medium priority: exploitation requires both application-specific configuration (VideoFrame bridging) and initial XSS foothold, making it non-automatable. Technical impact is high for affected applications as it defeats Electron's primary security boundary. Organizations using Electron apps that manipulate video content should prioritize this, while those not bridging VideoFrame objects face zero risk despite the high CVSS.

An attacker identifies an Electron-based video processing application that bridges VideoFrame objects to enable custom video manipulation features. The attacker discovers an XSS vulnerability in the application's web content (via insufficient input sanitization in a file name display or chat feature). Leveraging the XSS, the attacker injects JavaScript that intercepts a bridged VideoFrame object, uses its internal references to traverse into the isolated preload context, and accesses Node.js APIs like require('child_process') to execute arbitrary system commands. The attacker achieves full local code execution with the privileges of the application user, potentially accessing filesystem, credentials, or establishing persistence. The high attack complexity stems from requiring both the XSS vector and VideoFrame bridging, but impact is critical once both conditions are met.