CVE-2026-70598 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.
A vulnerability exists in Electron versions prior to 39.8.10, 40.0.0-alpha.1 through 40.9.0, 41.0.0-alpha.1 through 41.2.1, and 42.0.0-alpha.1 through 42.0.0-beta.3. In these versions, offscreen rendering frame data from the GPU process was not properly validated by the main process. This lack of validation could allow a compromised GPU process to manipulate memory access, causing the main process to read out-of-bounds memory while generating paint event images. As a result, this could lead to memory disclosure or application crashes. The vulnerability is only exploitable in applications that use offscreen rendering and where an attacker has gained code execution in the GPU process.
Users should update to Electron versions 39.8.10, 40.9.0, 41.2.1, or 42.0.0-beta.3.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |