CVE-2026-34773 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClient(protocol) did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes\, potentially hijacking existing protocol handlers. Apps are only affected if they call app.setAsDefaultProtocolClient() with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
A vulnerability exists in Electron's handling of default protocol clients on Windows. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, the framework's app.setAsDefaultProtocolClient() method did not properly validate protocol names before writing to the Windows registry. This flaw allows applications that use untrusted input for protocol names to write to arbitrary subkeys under HKCU\Software\Classes\, potentially hijacking existing protocol handlers. The issue affects only those applications that derive protocol names from external sources, while those using hardcoded names are not vulnerable.
To address this vulnerability, developers should update to Electron versions 38.8.6, 39.8.1, 40.8.1, or 41.0.0. Additionally, it's recommended to validate protocol names against a regular expression that ensures they conform to expected formats before passing them to the app.setAsDefaultProtocolClient() method.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/electron/electron/security/advisories/GHSA-mwmh-mq4g-g6gr | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| electronjs electron | < 38.8.6 >= 39.0.0, < 39.8.1 >= 40.0.0, < 40.8.1 41.0.0 alpha1 41.0.0 alpha2 41.0.0 alpha3 41.0.0 alpha4 41.0.0 alpha5 41.0.0 alpha6 41.0.0 beta1 41.0.0 beta2 41.0.0 beta3 41.0.0 beta4 41.0.0 beta5 41.0.0 beta6 41.0.0 beta7 41.0.0 beta8 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 4, 2026 | New CVE Received | [email protected] |