CVE-2026-34775: Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Published Apr 3, 2026

Updated

Impact The nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration.

Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected.

Workarounds Avoid enabling nodeIntegrationInWorker in apps that also open child windows or embed content with differing webPreferences.

Fixed Versions 41.0.0 40.8.4 39.8.4 38.8.6

For more information If there are any questions or comments about this advisory, please email security@electronjs.org

Other sources

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.

— MITRE

Affected Software

21 affected componentsFixes available

npm/electron>=41.0.0-alpha.1<41.0.0

41.0.0

npm/electron>=40.0.0-alpha.1<40.8.4

40.8.4

npm/electron>=39.0.0-alpha.1<39.8.4

39.8.4

npm/electron<38.8.6

38.8.6

electronjs Electron Node.js<38.8.6

electronjs Electron Node.js>=39.0.0<39.8.4

electronjs Electron Node.js>=40.0.0<40.8.4

electronjs Electron Node.js=41.0.0-alpha1

electronjs Electron Node.js=41.0.0-alpha2

electronjs Electron Node.js=41.0.0-alpha3

electronjs Electron Node.js=41.0.0-alpha4

electronjs Electron Node.js=41.0.0-alpha5

electronjs Electron Node.js=41.0.0-alpha6

electronjs Electron Node.js=41.0.0-beta1

electronjs Electron Node.js=41.0.0-beta2

electronjs Electron Node.js=41.0.0-beta3

electronjs Electron Node.js=41.0.0-beta4

electronjs Electron Node.js=41.0.0-beta5

electronjs Electron Node.js=41.0.0-beta6

electronjs Electron Node.js=41.0.0-beta7

electronjs Electron Node.js=41.0.0-beta8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 41.0.0
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 40.8.4
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 39.8.4
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 38.8.6
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 38.8.6
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 39.8.4
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 40.8.4
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 41.0.0
Configuration
Avoid enabling nodeIntegrationInWorker in apps that also open child windows or embed content with differing webPreferences; keep nodeIntegrationInWorker disabled unless required to prevent Node.js integration in shared renderer/process-sharing scenarios.
Electron BrowserWindow/WebPreferences nodeIntegrationInWorker = false

Event History

Apr 3, 2026

Advisory Published

via GitHub·02:43 AM

Data Sourced

via GitHub·02:43 AM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·11:55 PM

Data Sourced

via MITRE·11:55 PM

DescriptionSeverityWeakness

Apr 4, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeaknessAffected Software

CVE-2026-34775: Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Other sources

Affected Software

Remediation

Event History

Don't miss critical vulnerabilities

Company

Resources

Contact