GHSA-qmv3-fv6v-rmhq: Input Validation

Q: Which Electron applications are affected?

Only applications that load untrusted content are affected. Applications that do not load untrusted content are not affected.

Q: What access does an attacker need to exploit this issue?

An attacker needs to compromise a renderer. They can then cause their code to run in the preload context during a later load because cached sandboxed preload entries were not verified against the preload they were served for.

Q: Is there a mitigation if updating Electron is not immediately possible?

No app-side workaround is available. Updating Electron to a patched version is required.

Q: Which Electron versions include the fix?

The issue is fixed in Electron 42.10.0, 43.5.0, and 44.0.0-beta.6.

Published Sep 29, 2026

Updated

Impact

The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load.

Apps are only affected if they load untrusted content. Apps that do not load untrusted content are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

44.0.0-beta.6 43.5.0 42.10.0

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Affected Software

3 affected componentsFixes available

npm/electron>=44.0.0-alpha.1<44.0.0-beta.6

44.0.0-beta.6

npm/electron>=43.0.0-beta.1<43.5.0

43.5.0

npm/electron>=42.3.3<42.10.0

42.10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 44.0.0-beta.6
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 43.5.0
Upgrade
Upgrade npm/electron to a version that resolves this vulnerability.
Fixed in 42.10.0
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 42.10.0
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 43.5.0
Upgrade
Upgrade Electron to a version that resolves this vulnerability.
Fixed in 44.0.0-beta.6

Event History

Sep 29, 2026

Advisory Published

via GitHub·06:02 PM

Data Sourced

via GitHub·06:02 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which Electron applications are affected?

Only applications that load untrusted content are affected. Applications that do not load untrusted content are not affected.

What access does an attacker need to exploit this issue?