CVE-2026-102677: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
Impact
The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load.
Apps are only affected if they load untrusted content. Apps that do not load untrusted content are not affected.
Workarounds
There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions
44.0.0-beta.6 43.5.0 42.10.0
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 44.0.0-beta.6 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.5.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.10.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.10.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.5.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.0.0-beta.6
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using affected Electron releases that load untrusted content are affected. The attack depends on a renderer becoming compromised, so applications that do not expose untrusted content to renderers are not identified as affected by the advisory.
What does an attacker need to do to exploit the vulnerability?
An attacker needs to compromise a renderer and use it to write attacker-controlled sandboxed preload code-cache data. Electron may then reuse that cache data during a later load and execute it in the more privileged preload context.
Which Electron releases contain the fix?
The issue is fixed in Electron 42.10.0, 43.5.0, and 44.0.0-beta.6.