Skip to content

chore(deps): update dependency electron to v42 [security] - #736

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-electron-vulnerability
Open

chore(deps): update dependency electron to v42 [security]#736
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-electron-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
electron ^41.5.1 → ^42.0.0 age confidence

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

CVE-2026-70608 / GHSA-9f4c-93c8-jc8g

More information

Details

Impact

A sandboxed iframe without the allow-popups keyword could still open a new window (or trigger setWindowOpenHandler) with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction.

Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected. Apps that deny window creation in setWindowOpenHandler, or that do not embed untrusted content in sandboxed iframes, are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for any content you do not trust, rather than relying on the iframe sandbox alone.

Fixed Versions
  • 42.0.1
  • 41.10.3
  • 39.8.10
For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity

  • CVSS Score: 7.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Local race condition in Squirrel.Mac update installation on macOS

CVE-2026-102672 / GHSA-vv43-5jgx-7qv8

More information

Details

Impact

On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update. Exploitation requires local access to the machine.

Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions
  • 42.0.0-beta.2
  • 41.10.5
  • 39.8.10
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 6.7 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: can enable Node.js integration in Web Workers despite embedder restrictions

CVE-2026-102676 / GHSA-9qh4-3jw8-366w

More information

Details

Impact

A <webview> could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed.

Apps are only affected if they enable the <webview> tag and the embedder is unsandboxed. Apps that do not use <webview>, or that keep the embedder sandboxed, are not affected.

Workarounds

Remove nodeIntegrationInWorker from the guest preferences in a will-attach-webview handler, or do not enable the <webview> tag when loading untrusted content.

Fixed Versions
  • 44.0.0-beta.5
  • 43.4.1
  • 42.9.2
  • 41.10.6
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

CVE-2026-102674 / GHSA-gr2m-v5gq-v685

More information

Details

Impact

Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes.

Apps are only affected if they render untrusted content in a sandboxed top-level document that allows popups. Apps that deny popups from untrusted content with setWindowOpenHandler are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content.

Fixed Versions
  • 44.0.0-beta.5
  • 43.4.1
  • 42.9.2
  • 41.10.6
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

CVE-2026-102673 / GHSA-hq2x-r82h-9wj4

More information

Details

Impact

Popups opened from a sandboxed iframe through a link (for example target="_blank" or a middle-click) did not inherit the iframe's HTML sandbox restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining access to that origin's cookies, storage, and same-origin scripting.

Apps are only affected if they embed untrusted content in iframes sandboxed with allow-scripts allow-popups. Apps that do not embed untrusted content in sandboxed iframes are not affected.

Workarounds

Use setWindowOpenHandler on the parent WebContents to deny or constrain popups opened from sandboxed frames, or do not apply allow-popups to sandboxed iframes that render untrusted content.

Fixed Versions
  • 43.0.0
  • 42.5.2
  • 41.10.4
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

CVE-2026-102675 / GHSA-j84w-jfhq-vhvj

More information

Details

Impact

Responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI: true but without corsEnabled: true could be read cross-origin by web content. This completes the fix for CVE-2026-70604.

Apps are only affected if they register such a scheme, serve it through one of those handlers, and load untrusted content. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.

Workarounds

Set corsEnabled: true on the scheme, or do not load untrusted content in windows that can reach it.

Fixed Versions
  • 44.0.0-beta.5
  • 43.4.1
  • 42.9.2
  • 41.10.6
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 7.4 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: HID and USB permission checks can be attributed to the wrong origin

CVE-2026-113800 / GHSA-fw47-9c62-h3vw

More information

Details

Impact

For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.

You're only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow="hid" or allow="usb". Apps that don't delegate those features to untrusted iframes are not affected.

Workarounds

Don't add allow="hid" / allow="usb" to untrusted iframes, or make the decision in your select-hid-device / select-usb-device handler using details.frame.

Fixed Versions
  • 45.0.0-alpha.5
  • 44.3.0
  • 43.7.0
  • 42.11.3
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: openExternal permission requests can be attributed to the wrong origin

CVE-2026-114121 / GHSA-997q-gvvc-jwmx

More information

Details

Impact

Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.

Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies openExternal for untrusted content are not affected.

Workarounds

Deny the openExternal permission for untrusted content, or deny the windows it opens with setWindowOpenHandler.

Fixed Versions
  • 45.0.0-alpha.5
  • 44.3.0
  • 43.7.0
  • 42.11.3
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

CVE-2026-114124 / GHSA-h3v5-h239-pg29

More information

Details

Impact

In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths.

Apps are only affected if they use offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions
  • 45.0.0-alpha.9
  • 44.4.3
  • 43.7.3
  • 42.11.6
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 3.9 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Frame subscription trusts GPU-supplied frame geometry

CVE-2026-114122 / GHSA-3qxv-5xgr-q7w9

More information

Details

Impact

Frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app.

Apps are only affected if they use webContents.beginFrameSubscription and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions
  • 45.0.0-alpha.9
  • 44.4.3
  • 43.7.3
  • 42.11.6
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 3.9 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

CVE-2026-113797 / GHSA-98mx-cjp9-gchm

More information

Details

Impact

chrome.tabs.query() returned each tab's url and title to extensions that held neither the tabs permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session.

Apps are only affected if they load extensions (session.extensions.loadExtension) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.

Workarounds

Do not load untrusted or unvalidated extensions. In general you should only load trusted extensions.

Fixed Versions
  • 45.0.0-alpha.4
  • 44.1.1
  • 43.5.1
  • 42.11.1
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 3.1 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Pointer lock permission requests can be attributed to the wrong frame

CVE-2026-113798 / GHSA-x562-297c-g43g

More information

Details

Impact

For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.

Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not embed untrusted content, or that deny pointerLock for it, are not affected.

Workarounds

Deny the pointerLock permission for web contents that embed untrusted frames.

Fixed Versions
  • 45.0.0-alpha.13
  • 44.5.0
  • 43.7.6
  • 42.11.9
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: SameSite cookie restrictions are not applied to windows opened from links

CVE-2026-113796 / GHSA-2p8c-gr87-2676

More information

Details

Impact

Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: SameSite=Strict cookies were sent and Sec-Fetch-Site did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence.

Apps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with setWindowOpenHandler are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content.

Fixed Versions
  • 45.0.0-alpha.6
  • 44.3.0
  • 43.7.0
  • 42.11.3
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 4.2 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Electron: Mitigation for compromised eMudhra intermediate certificates

CVE-2026-115570 / GHSA-jr5w-w6x2-84p9

More information

Details

Impact

A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js tls, https and fetch. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app.

Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected.

Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470).

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions
  • 45.0.0-beta.6
  • 44.9.1
  • 43.8.1
  • 42.11.16
For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity

  • CVSS Score: 7.4 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

electron/electron (electron)

v42.11.16: electron v42.11.16

Compare Source

Release Notes for v42.11.16

[!NOTE]
This release contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates

Fixes

  • Fixed link-opened windows not using the opener's session and webPreferences. #​55050 (Also in 43, 44, 45)
  • Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #​55054 (Also in 43, 44, 45)

v42.11.15: electron v42.11.15

Compare Source

Release Notes for v42.11.15

Fixes

  • Fixed a crash on Linux at startup or on theme change with GTK modules loaded. #​55015
  • Fixed an issue where clicks posted to a background app were dropped on macOS. #​54906 (Also in 43, 44, 45)
  • Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #​54925 (Also in 43, 44, 45)
  • Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #​55000 (Also in 43, 45)

Other Changes

  • Backported fixes from upstream Chromium and V8. #​55035

v42.11.14: electron v42.11.14

Compare Source

Release Notes for v42.11.14

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, PDFium and V8. #​54900

v42.11.13: electron v42.11.13

Compare Source

Release Notes for v42.11.13

Fixes

  • Fixed a crash when starting without an available display server on Linux. #​54796 (Also in 45)

v42.11.12: electron v42.11.12

Compare Source

Release Notes for v42.11.12

Fixes

  • Fixed a renderer crash when a ResizeObserver loop-limit error handler modified layout. #​54610 (Also in 43, 44, 45)

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. #​54668
  • Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. #​54659

v42.11.11: electron v42.11.11

Compare Source

Release Notes for v42.11.11

Fixes

  • Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. #​54598

v42.11.10: electron v42.11.10

Compare Source

Release Notes for v42.11.10

Other Changes

  • Backported fixes from upstream ANGLE, Chromium, Dawn and V8. #​54565

v42.11.9: electron v42.11.9

Compare Source

Release Notes for v42.11.9

Fixes

  • Fixed clipboard.read(), readText() and has() resolving seconds late on Linux while the app was idle. #​54310 (Also in 43, 44, 45)
  • Fixed fs.rmSync failing to remove read-only files on Windows. #​54257 (Also in 43, 44, 45)
  • Fixed pointerLock permission requests from some iframes reporting the parent frame. #​54466 (Also in 43, 44, 45)
  • Fixed utilityProcess dropping stdout/stderr output that the child wrote immediately before exiting. #​54332 (Also in 43, 44, 45)
  • Fixed WebAssembly exception handlers failing to catch, or crashing during tier-up, in modules using wasm exceptions. #​54236
  • Fixed WebAssembly modules loaded from the code cache crashing or throwing RuntimeError: unreachable after updating between certain patch releases. [#​54239](https://redirect.github.com/electron/electron/pull

[!IMPORTANT]
✂ PR body was truncated to here.

@renovate
renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from c7afdf9 to dc84d37 Compare August 11, 2026 22:30
@renovate
renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from dc84d37 to 15d70d8 Compare September 7, 2026 21:42
@renovate
renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from 15d70d8 to 8edb2e5 Compare September 24, 2026 20:19
@renovate renovate Bot changed the title chore(deps): update dependency electron to v41.10.3 [security] chore(deps): update dependency electron to v41.10.5 [security] Sep 30, 2026
@renovate
renovate Bot force-pushed the renovate/npm-electron-vulnerability branch 2 times, most recently from e2ee2d3 to c65ef52 Compare October 2, 2026 13:57
@renovate renovate Bot changed the title chore(deps): update dependency electron to v41.10.5 [security] chore(deps): update dependency electron to v41.10.6 [security] Oct 2, 2026
@renovate
renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from c65ef52 to 2a3efac Compare October 13, 2026 19:12
@renovate
renovate Bot force-pushed the renovate/npm-electron-vulnerability branch 3 times, most recently from 2d26582 to c1973a1 Compare October 23, 2026 19:42
@renovate renovate Bot changed the title chore(deps): update dependency electron to v41.10.6 [security] chore(deps): update dependency electron to v42 [security] Oct 23, 2026
@renovate
renovate Bot force-pushed the renovate/npm-electron-vulnerability branch from c1973a1 to f7553f1 Compare October 24, 2026 18:09
@sonarqubecloud

sonarqubecloud Bot commented Oct 24, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants