CVE-2026-114122: Electron: Frame subscription trusts GPU-supplied frame geometry
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could supply inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing captured frame images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.7.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.4.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.9
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker must first obtain code execution in Electron's GPU process. Exploitation then requires use of webContents.beginFrameSubscription, through which inconsistent GPU-supplied frame geometry can trigger an out-of-bounds read in the main process.
What is the practical impact if exploitation succeeds?
The application may disclose memory while producing captured frame images or crash. The issue does not describe modification of memory or data.
Which Electron releases contain the fix?
The issue is fixed in Electron 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9. Versions prior to those releases are affected.