EUVD-2026-53435
GHSA-m55f-7gqj-fr98
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
PR:H because the attacker must control an extension the app has explicitly loaded; AC:H for the required multi-session architecture; S:C and C:H for cross-session confidentiality breach.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
AnalysisAI
Session isolation bypass in Electron allows a malicious or compromised Chrome extension loaded into one session to cross session boundaries and access, navigate, and script windows belonging to a completely separate session. Affected are Electron applications prior to versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 that invoke session.loadExtension and rely on multi-session architecture as a security boundary - a narrowly scoped but architecturally significant trust boundary violation. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires attacker control of an extension the application has explicitly loaded.
Technical ContextAI
Electron wraps Chromium and Node.js to build cross-platform desktop applications distributed via the npm ecosystem (cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*). The framework exposes a session API that allows developers to create logically isolated browser sessions with independent storage, cookies, and extension contexts - a design used to sandbox untrusted or privileged content from one another. The root cause (CWE-284: Improper Access Control) is that Electron's extension tab and chrome.scripting APIs - which allow an extension to enumerate, navigate, and inject scripts into browser windows - were not scoped to the session that loaded the extension. Instead, these APIs could enumerate and operate on windows belonging to any session in the process, violating the intended session-level isolation boundary.
RemediationAI
Upgrade to Electron 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3 depending on the active release track, as confirmed by the official GitHub Security Advisory GHSA-m55f-7gqj-fr98. These versions correctly scope extension tab and scripting APIs to the extension's own session. If immediate upgrade is not feasible, the vendor-recommended workaround is to load extensions exclusively from fully trusted, verified sources and remove any architectural reliance on session separation alone as an extension containment boundary - note this does not patch the underlying API scoping flaw and should be treated as a temporary measure only. Applications that do not invoke session.loadExtension or that use a single session require no action. Advisory and package fix ranges are documented at https://github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated hi
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is r
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated c
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated crit
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious proto
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today