What is the CVSS score of CVE-2026-34780?

CVE-2026-34780 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-34780?

CVE-2026-34780 is a context isolation bypass in Electron applications that allows attackers with cross-site scripting (XSS) capabilities to escalate privileges and access Node.js APIs through…. A patch is available.

How to fix or mitigate CVE-2026-34780?

Within 24 hours: Identify all Electron applications in production using WebCodecs API VideoFrame bridging to main world context; document current Electron versions deployed. Within 7 days: Implement input validation and XSS prevention controls (Content Security Policy, input sanitization) for all affected applications; restrict VideoFrame object exposure to isolated contexts only; review preload script permissions and remove unnecessary Node.js API exposure. Within 30 days: Upgrade to patched Electron release when available; conduct security code review of context isolation implementation across all Electron applications; establish monitoring for VideoFrame object manipulation attempts.

Node.js CVE-2026-34780

MEDIUM

Exposure of Resource to Wrong Sphere (CWE-668)

2026-04-03 https://github.com/electron/electron

GHSA-jfqg-hf23-qpw2

XSS Information Disclosure Node.js

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Red Hat

8.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 30, 2026 - 03:24 NVD

HIGH MEDIUM

CVSS changed

Jun 30, 2026 - 03:24 NVD

8.3 (HIGH) 6.1 (MEDIUM)

Patch released

Apr 03, 2026 - 08:30 nvd

Patch available

Analysis Generated

Apr 03, 2026 - 03:00 vuln.today

CVE Published

Apr 03, 2026 - 02:46 nvd

HIGH 8.3

DescriptionNVD

Impact

Apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script.

Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected.

Workarounds

Do not pass VideoFrame objects across contextBridge. If an app needs to transfer video frame data, serialize it to an ArrayBuffer or ImageBitmap before bridging.

Fixed Versions

41.0.0-beta.8
40.7.0
39.8.0

For more information

If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)

AnalysisAI

Context isolation bypass in Electron applications enables privilege escalation when VideoFrame objects are bridged to the main world. Attackers with XSS capabilities can leverage improperly bridged WebCodecs API VideoFrame objects to escape the isolated context and access Node.js APIs exposed in preload scripts. CVSS 8.4 (High) with network attack vector requiring high complexity and user interaction. No public exploit identified at time of analysis, though proof-of-concept development is feasible given the detailed vendor disclosure.

Technical ContextAI

Electron's contextBridge API is designed to safely expose limited APIs from the isolated preload script context to the untrusted main world renderer context. This vulnerability (CWE-668: Exposure of Resource to Wrong Sphere) affects Electron's handling of VideoFrame objects from the WebCodecs API when passed through contextBridge.exposeInMainWorld(). The VideoFrame object contains internal references that, when improperly sanitized during context bridging, create a capability leak allowing main world JavaScript to traverse back into the isolated context. The WebCodecs API provides low-level access to video encoders/decoders, and VideoFrame represents raw video frame data with associated metadata. The vulnerability specifically affects the npm package 'electron' across versions prior to the patched releases, exploiting the object serialization boundary between Node.js-enabled isolated contexts and the browser-like main world.

RemediationAI

Vendor-released patches are available: upgrade to Electron 41.0.0-beta.8 or later for version 41.x applications, upgrade to 40.7.0 or later for version 40.x applications, or upgrade to 39.8.0 or later for version 39.x applications. The patches fix the improper object handling when VideoFrame objects cross the context isolation boundary. For applications unable to upgrade immediately, implement the recommended workaround by avoiding direct bridging of VideoFrame objects across contextBridge; instead, serialize video frame data to ArrayBuffer or ImageBitmap formats before passing to the main world, which eliminates the capability leak. Review preload scripts and contextBridge.exposeInMainWorld() implementations to identify any VideoFrame bridging patterns. Complete remediation guidance and patched versions are documented in the GitHub Security Advisory at https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2. Contact security@electronjs.org for implementation questions.