CVE-2026-114124: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.7.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.4.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.9
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue affects Electron applications using macOS offscreen rendering and versions earlier than 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9, depending on the release line.
What must an attacker achieve before exploiting this issue?
An attacker must first obtain code execution in the GPU process. They can then provide inconsistent frame geometry to trigger an out-of-bounds read in the main process while paint event images are produced.
What is the likely impact?
Successful exploitation can disclose memory from the main process or crash the application. The provided severity is low, with local access, high attack complexity, and high privileges required.
How can the issue be remediated?
Upgrade Electron to 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9, as appropriate for the release line in use.