CVE-2026-34774 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0.
A use-after-free vulnerability has been identified in Electron applications that use offscreen rendering and allow child windows via window.open(). This issue arises when the parent offscreen WebContents is destroyed while a child window remains open, leading to subsequent paint frames on the child dereferencing freed memory. This can cause a crash or memory corruption. The vulnerability affects Electron versions prior to 39.8.1, versions 40.0.0-alpha.1 through 40.7.0, and versions 41.0.0-alpha.1 through 41.0.0.
To address this vulnerability, Electron applications can be updated to version 39.8.1, 40.7.0, or 41.0.0. Alternatively, child window creation from offscreen renderers can be denied in the setWindowOpenHandler, or developers can ensure that child windows are closed before the parent is destroyed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-34774 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2455026 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34774.json | redhat-SADP | |
| https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-825 | Expired Pointer Dereference | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| electronjs electron | < 39.8.1 >= 40.0.0, < 40.7.0 41.0.0 alpha1 41.0.0 alpha2 41.0.0 alpha3 41.0.0 alpha4 41.0.0 alpha5 41.0.0 alpha6 41.0.0 beta1 41.0.0 beta2 41.0.0 beta3 41.0.0 beta4 41.0.0 beta5 41.0.0 beta6 41.0.0 beta7 41.0.0 beta8 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 4, 2026 | New CVE Received | [email protected] |