EUVD-2026-53543
GHSA-ff2p-hmqr-hxm4
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Network vector because untrusted web content is the attack source; AC:H because exploitation requires non-default preload coding patterns; S:C reflects the renderer-to-preload context boundary crossing; C:L/I:L because impact is bounded by what the preload exposes.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.
AnalysisAI
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious prototype across the isolation boundary into preload script context, bypassing context isolation in versions prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4. Exploitation is conditional on preload scripts accepting object arguments from untrusted content and reading inherited properties without own-property guards. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the scope-change (S:C) CVSS metric reflects that a successful attack crosses the renderer-to-preload privilege boundary, which can have amplified consequences in apps that expose sensitive Node.js APIs through the bridge.
Technical ContextAI
Electron's contextBridge is the sanctioned V8-level mechanism for sharing JavaScript values between the sandboxed renderer context (untrusted web content) and the privileged preload context (which has access to Node.js APIs). The root cause is CWE-1321 (Prototype Pollution): the C++ bridge implementation in electron_api_context_bridge.cc used V8's generic Set() API to copy object properties from one context to the other. When an object with an own property literally named __proto__ was passed across the bridge, the Set() call invoked the inherited Object.prototype.__proto__ setter in the destination context, mutating the destination object's prototype chain rather than writing a plain own data property. The fix (PR #51083) substitutes CreateDataProperty(), which unconditionally writes an own data property regardless of the key name, eliminating setter invocation. The affected package is npm/electron (cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*) across all major release lines below the fixed versions.
RemediationAI
Upgrade to a patched Electron release: v39.8.9 (https://github.com/electron/electron/releases/tag/v39.8.9), v40.9.2 (https://github.com/electron/electron/releases/tag/v40.9.2), v41.2.2 (https://github.com/electron/electron/releases/tag/v41.2.2), or v42.0.0-beta.4 (https://github.com/electron/electron/releases/tag/v42.0.0-beta.4). The patch is available in published GitHub releases and confirmed by the GHSA advisory. If an immediate framework upgrade is not feasible, the vendor-recommended interim workaround is to audit all preload bridge APIs that accept object arguments and replace bare property reads (e.g., obj.prop) with own-property checks using Object.hasOwn(obj, key) - this prevents access to prototype-injected values. Alternatively, copy inbound objects onto a null-prototype container before use: const safe = Object.assign(Object.create(null), untrustedObj), which strips the entire prototype chain. Both workarounds require preload code changes and add developer burden; they should not substitute for the framework patch long-term.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today