Skip to content
Log inStart free trial

GHSA-jfqg-hf23-qpw2 CVE-2026-34780

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

Medium npm
Severity
8.3 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.33%
Chance of exploitation in the next 30 days. Higher than 25.82% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-1188 Initialization of a Resource with an Insecure Default
CWE-668 Exposure of Resource to Wrong Sphere
Fix
39.8.0
Upgrade electron to this version or later

Description

Impact

Apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script.

Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected.

Workarounds

Do not pass VideoFrame objects across contextBridge. If an app needs to transfer video frame data, serialize it to an ArrayBuffer or ImageBitmap before bridging.

Fixed Versions

  • 41.0.0-beta.8
  • 40.7.0
  • 39.8.0

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Affected versions

npm

PackageVulnerableFixed in
electron
>= 39.0.0-alpha.1, < 39.8.0
39.8.0
electron
>= 40.0.0-alpha.1, < 40.7.0
40.7.0
electron
>= 41.0.0-alpha.1, < 41.0.0-beta.8
41.0.0-beta.8

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

electron npm → 39.8.0

npm
npm install electron@39.8.0
yarn
yarn add electron@39.8.0
pnpm
pnpm add electron@39.8.0

Severity breakdown

CVSS 3.1 8.3

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-1188: Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

CWE-668: Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-qqvq-6xgj-jw8g
Electron affected by libvpx's heap buffer overflow in vp8 encoding
High Known exploited Also affects electron
GHSA-j7hp-h8jx-5ppr
libwebp: OOB write in BuildHuffmanTable
High Known exploited Also affects electron
GHSA-995f-9x5r-2rcj
Heap buffer overflow in GPU
Critical Known exploited Also affects electron
GHSA-jr5w-w6x2-84p9
Electron: Mitigation for compromised eMudhra intermediate certificates
High Also affects electron
GHSA-h3v5-h239-pg29
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Low Also affects electron
GHSA-3qxv-5xgr-q7w9
Electron: Frame subscription trusts GPU-supplied frame geometry
Low Also affects electron
GHSA-997q-gvvc-jwmx
Electron: openExternal permission requests can be attributed to the wrong origin
Medium Also affects electron
GHSA-fw47-9c62-h3vw
Electron: HID and USB permission checks can be attributed to the wrong origin
Medium Also affects electron
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor