EUVD-2026-53445
GHSA-r4w5-6pfg-jxp5
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Network vector applies as the protocol handler processes network-fetched URLs; AC:H because cross-session cache reuse requires specific app architecture and timing; PR:N since no attacker authentication is needed; C:H because full session-scoped cached content can be disclosed across partition boundaries.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.
AnalysisAI
Session isolation bypass in Electron's custom protocol handler allows cached HTTP responses from defaultSession to leak across otherwise isolated session partitions. Electron versions 40.x through pre-release 43.x are affected when apps use ProtocolResponse.url without specifying ProtocolResponse.session, causing upstream requests to be routed through defaultSession regardless of which session registered the protocol handler. An attacker who can trigger a cross-session cache hit may read confidential session-scoped content (C:H) or partially influence cached responses (I:L) intended for a different, isolated session; no public exploit or CISA KEV listing exists at time of analysis.
Technical ContextAI
Electron (npm package electron, CPE cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*) is a cross-platform desktop application framework built on Chromium and Node.js. The vulnerability resides in the custom protocol handler subsystem: when a handler returns a ProtocolResponse with a url redirect but omits the optional session field, Electron silently falls back to defaultSession for the upstream network request rather than using the session that originally registered the handler. Because HTTP responses are cached at the session level, a response fetched via defaultSession can be served from cache into a completely different, otherwise isolated session partition. CWE-668 (Exposure of Resource to Wrong Sphere) precisely describes this root cause - a resource (the cached response) is accessible in a security sphere (another session partition) where it should not be. Electron's session partition model is commonly used to enforce security boundaries between tenants, users, or privilege levels in desktop apps, making this bypass potentially significant in architecturally session-dependent applications.
RemediationAI
Upgrade Electron to a patched release: 40.10.6 (for 40.x deployments), 41.9.1 (for 41.x), 42.5.1 (for 42.x), or 43.0.0 (for 43.x pre-release). Full details are in the vendor advisory at https://github.com/electron/electron/security/advisories/GHSA-r4w5-6pfg-jxp5. If an immediate upgrade is not feasible, the vendor-documented workaround is to explicitly set the session field on every ProtocolResponse object returned by custom protocol handlers, ensuring the upstream request is routed through the correct session rather than defaultSession. This workaround is low-risk and backward-compatible but requires a targeted code audit of all custom protocol handler registrations in the application; omitting even one handler leaves the isolation bypass intact for that handler. Security contact for questions: security@electronjs.org.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated hi
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is r
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated c
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated crit
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious proto
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Same weakness CWE-668 – Exposure of Resource to Wrong Sphere
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today