Electron EUVD-2026-53435

Three specific conditions must all be true simultaneously for exploitation to be possible. First, the Electron application must explicitly call session.loadExtension to load a Chrome extension - applications that do not use extensions are entirely unaffected. Second, the application must use multiple distinct sessions as a deliberate security isolation mechanism; applications using only a single session are not affected regardless of extension use. Third, the loaded extension must be malicious or compromised - the CVSS PR:H rating confirms that the attacker must exercise control at the extension level, which the application has explicitly granted load authorization. The limiting factors are substantial: the flaw is inert in the vast majority of Electron deployments that either do not load extensions or do not rely on session separation as a trust boundary.

The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N - 6.6) accurately reflects the constrained but meaningful nature of this flaw. AC:H acknowledges that the attacker must operate within an Electron app specifically configured with multi-session isolation and extension loading - a non-default, intentional architectural choice. PR:H correctly captures that the attacker must control a loaded extension, representing substantial prior access. The Scope Change (S:C) and C:H combination is significant: once conditions are met, the attacker can fully read content from a session they were never supposed to access. No EPSS score was provided. No CISA KEV listing and no public POC exist in the provided data, indicating no confirmed widespread exploitation. Overall, this is a real security failure for affected architectures - developers using multi-session isolation as a trust boundary have been operating with a false assumption - but the real-world attack surface is limited to Electron apps deliberately using this specific pattern.

An attacker supplies a malicious Chrome extension - either through a compromised extension update, a social engineering campaign, or by exploiting a separate extension-installation pathway - that is loaded by an Electron application using session.loadExtension with a multi-session architecture. Once the extension is active in its assigned session, it calls cross-session tab enumeration and scripting APIs to read sensitive data (credentials, session tokens, proprietary content) from windows running in an isolated session that the application developer believed was inaccessible to the extension. No public POC is available at time of analysis.