EUVD-2026-107369
GHSA-98mx-cjp9-gchm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLoad untrusted extension via loadExtension
-
ExploitExtension calls chrome.tabs.query()
-
ExecutionReceive url/title without tabs/host permission
-
ImpactExfiltrate session browsing data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Electron application itself load an extension it does not fully trust through session.extensions.loadExtension, AND that the extension holds neither the 'tabs' permission nor matching host permissions. Under those conditions the extension can call chrome.tabs.query() and read the url and title of every webContents in that session. Limiting factors: this is NOT a default or remote-attacker path - the hosting app must explicitly opt into loading untrusted/third-party extensions, which the vast majority of Electron apps never do; the affected versions must predate 42.11.1 / 43.5.1 / 44.1.1 / 45.0.0-alpha.4; and the disclosed data is limited to tab URLs and titles (no page content, DOM, cookies, or code execution). |
| Impact | This is a genuinely low-priority issue, and the available signals are consistent in pointing that way rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, base 3.1 Low) reflects a limited information-disclosure flaw: only Confidentiality is affected, and only at Low (tab URLs and titles - no page content, no code execution). No EPSS score, CISA KEV listing, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis'; absence of these is unsurprising for a low-impact authorization gap. The vector marks PR:N (the malicious extension deliberately holds NO privileges - that is the essence of the bug) and UI:R plus AC:H, which correctly capture the real gating condition: a developer/operator must have loaded an extension they do not fully trust via session.extensions.loadExtension. The CWE-862 (Missing Authorization) classification matches the root cause shown in the patch - chrome.tabs.query() populated title/url before checking the kTab permission or host permission. One caveat to verify: the input Tags label this 'Authentication Bypass,' but it is an authorization (permission-enforcement) failure, not authentication bypass. Net: a real but minor defense-in-depth fix, not an urgent patch-now vulnerability except for the narrow population of apps that load untrusted extensions. |
| Exploit ScenarioDerived | An Electron application loads a third-party extension it does not fully trust via session.extensions.loadExtension, granting it neither the 'tabs' permission nor any host permissions. The extension calls chrome.tabs.query({}) and, due to the missing authorization check, receives the url and title of every webContents in that session - effectively a browsing-history/activity leak to code that should have been blind to it. No public exploit code was identified at time of analysis; the fix enforces CanAccessPrivilegedTabFields() before returning those properties. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Electron's chrome.tabs.query() implementation returned the url and title of every tab in a session to extensions that held neither the 'tabs' permission nor a matching host permission, letting a loaded extension enumerate the URLs and titles of all webContents in that session. Only applications that explicitly pull in extensions they do not fully trust via session.extensions.loadExtension are exposed, and only on builds prior to 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4; unauthenticated remote attackers cannot reach the flaw without such an extension already running inside the app. The disclosed data is limited to tab URLs and titles (no page content, DOM, cookies, or code execution), no public exploit code was identified at time of analysis, and the issue does not appear on CISA KEV, consistent with its low CVSS 3.1 score.
RemediationAI
Upgrade to Electron 42.11.1, 43.5.1, 44.1.1, or 45.0.0-alpha.4 (or later); these are vendor-released patches, and the corresponding PRs #52597, #53353, #53354, #53355, and #53356 are referenced from advisory GHSA-98mx-cjp9-gchm and the release tags. If an upgrade cannot be shipped immediately, the effective compensating control is to stop calling session.extensions.loadExtension with extensions that are not fully trusted - bundle only first-party extensions, pin and review any third-party extension manifests, and verify at load time that each extension either genuinely needs the 'tabs' permission or is confined to origins it is allowed to see. Trade-off: granting the 'tabs' permission to an extension makes the leak 'authorized' rather than fixing it, so it should only be done for extensions that legitimately require full tab metadata, and host-scoping an extension narrows the disclosure to those origins at the cost of breaking functionality on other sites. Because the leaked data is limited to tab URLs and titles, blocking loadExtension for untrusted code removes the exposure entirely without affecting normal BrowserWindow/webContents rendering.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Electron reimplements Chromium's extension APIs in C++ under shell/browser/extensions/api/tabs/tabs_api.cc, where tab 'url' and 'title' are treated as privileged fields gated by the 'tabs' API permission or a host permission covering the tab's origin. The root cause is CWE-862 (Missing Authorization): TabsQueryFunction only applied the permission check inside the url_patterns branch, so a query with an empty pattern list - chrome.tabs.query({}) - bypassed the gate entirely and the handler still populated tab.title and tab.url for every WebContents in the session. The fix factors the check into a shared CanAccessPrivilegedTabFields() helper that tests HasAPIPermissionForTab(kTab) or HasHostPermission() against the last committed URL, uses it to decide whether a tab matches at all, and only assigns title/url when privileged access is confirmed; the same helper is now applied to TabsGetFunction and TabsUpdateFunction, which had similar logic, and matching was switched to the committed URL. Regression coverage was added in spec/extensions-spec.ts using a no-privileges chrome-tabs fixture that calls query and asserts the returned tabs expose only numeric ids. The affected component is Electron's own extension host (session.extensions.loadExtension), not upstream Chromium's extension system, which already enforced this separation.
Know when Electron gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
The malicious extension legitimately holds no permissions (PR:N), but an operator must first load an untrusted extension (UI:R, AC:H), and only tab url/title leak (C:L, I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
Remote code execution in 5ire 0.15.2 and earlier arises because the desktop AI assistant renders Mermaid diagrams with s
Cross-site scripting in DeepChat's Mermaid diagram renderer escalates to full remote code execution on affected desktop
Remote code execution in DeepChat 0.5.1 and below is possible through a cross-site scripting flaw in Mermaid diagram ren
Stored cross-site scripting in SiYuan through 3.8.4 lets an attacker who can set a notebook name containing an HTML payl
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated hi
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is r
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Exploit-DB