CVE-2026-115570: Electron: Mitigation for compromised eMudhra intermediate certificates
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.16 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.8.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.9.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-beta.6
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Electron applications using versions earlier than 42.11.16, 43.8.1, 44.9.1, or 45.0.0-beta.6 are affected. The exposure applies to TLS connections made through Chromium networking, Node.js tls, Node.js https, or Node.js fetch.
What does an attacker need to exploit the vulnerability?
The attacker must possess a certificate issued through one of the compromised eMudhra intermediate certificates and be able to intercept the application's network traffic. No privileges or user interaction are required according to the provided severity vector.
What is the impact of a successful attack?
An attacker can impersonate a TLS server to the affected Electron application. This can compromise the confidentiality and integrity of traffic, while availability is not identified as affected.
Which versions contain the fix?
The issue is fixed in Electron 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6. Upgrade to the applicable fixed release for the Electron version line in use.