CVE-2026-34780 - Vulnerability Analysis

Overview

Electron 39.0.0-alpha.1 to < 39.8.0, 40.0.0-alpha.1 to < 40.7.0, and 41.0.0-alpha.1 to < 41.0.0-beta.8 contain a context isolation bypass caused by passing VideoFrame objects across contextBridge, letting attackers with main world JavaScript execution access isolated world and Node.js APIs, exploit requires preload script to expose VideoFrame via contextBridge.

Severity & Score

Impact

Attackers with main world JavaScript execution can bypass context isolation and access Node.js APIs, potentially leading to full system compromise.

Mitigation

Update to versions 39.8.0, 40.7.0, or 41.0.0-beta.8 or later.

References

• https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner