EUVD-2026-53420
GHSA-pfmc-3mgc-p6fp
Severity by source
AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L
Local attack vector and high privileges reflect GPU subprocess control requirement; high complexity for mandatory prior compromise; scope changed as read crosses into browser process; no integrity impact from a read-only flaw.
Primary rating from Vendor (https://github.com/electron/electron).
CVSS VectorVendor: https://github.com/electron/electron
Lifecycle Timeline
3DescriptionCVE.org
Impact
In offscreen rendering mode, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app.
Apps are only affected if they use offscreen rendering (webPreferences.offscreen) and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
42.0.0-beta.341.2.140.9.039.8.10
For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
AnalysisAI
Out-of-bounds memory read in Electron's offscreen rendering pipeline allows a compromised GPU process to cause the browser/main process to read beyond a shared memory mapping boundary when producing paint event images, disclosing process memory or crashing the application. Exploitation requires two independent preconditions: the host application must enable webPreferences.offscreen (non-default) and an attacker must have already achieved code execution in the GPU process via a separate vulnerability. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Electron's multi-process architecture (pkg:npm/electron) separates rendering into a sandboxed GPU process that communicates with the browser/main process over Mojo IPC using shared memory segments. In offscreen rendering mode (OSR), the GPU process supplies frame geometry - specifically pixel_size and content_rect - alongside a shared memory region containing pixel data. The vulnerable code in osr_host_display_client.cc and osr_video_consumer.cc used GPU-supplied geometry to size Skia canvas objects without first verifying that the claimed dimensions were bounded by the actual shared memory mapping size. CWE-125 (Out-of-bounds Read) is the root cause: a hostile GPU process could advertise an oversized content_rect backed by an undersized mapping, causing the main process to compute a required_bytes value exceeding mapping.size() and subsequently read past the allocation boundary. The fix, committed at 2c24640e7b0b9c74fe9f44bce0fde138340ff4fb, adds explicit geometry-vs-mapping size checks in both OnAllocatedSharedMemory and OnFrameCaptured, and switches from CRASH_ON_FAILURE to RETURN_NULL_ON_FAILURE to prevent forced crashes on bad input.
RemediationAI
Upgrade Electron to one of the patched releases: 39.8.10, 40.9.0, 41.2.1, or 42.0.0-beta.3, depending on the release series in use. The vendor explicitly states there are no application-side workarounds - the fix is entirely within the Electron framework itself and cannot be replicated by app developers through configuration or code changes. The upstream code fix is available at commit 2c24640e7b0b9c74fe9f44bce0fde138340ff4fb. Applications that do not require offscreen rendering can mitigate exposure entirely by ensuring webPreferences.offscreen is not set to true, which removes the vulnerable code path from the attack surface, though this does not address the underlying deficiency in Electron's IPC validation. Consult the security advisory at https://github.com/electron/electron/security/advisories/GHSA-pfmc-3mgc-p6fp for authoritative guidance.
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today