{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "electron: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/electron--electron/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/electron--electron/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115570/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115570/",
   "title": "CVE-2026-115570 disclosed",
   "content_text": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.",
   "date_published": "2026-10-23T18:13:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115570/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115570/",
   "title": "CVE-2026-115570 fixed upstream (npm)",
   "content_text": "Fixed versions: electron 42.11.16, electron 43.8.1, electron 44.9.1, electron 45.0.0-beta.6.",
   "date_published": "2026-10-23T18:13:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102677/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102677/",
   "title": "CVE-2026-102677 disclosed",
   "content_text": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.",
   "date_published": "2026-09-29T17:43:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102677/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102677/",
   "title": "CVE-2026-102677 fixed upstream (npm)",
   "content_text": "Fixed versions: electron 42.10.0, electron 43.5.0, electron 44.0.0-beta.6.",
   "date_published": "2026-09-29T17:43:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102676/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102676/",
   "title": "CVE-2026-102676 disclosed",
   "content_text": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron \u003cwebview\u003e guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the \u003cwebview\u003e tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.",
   "date_published": "2026-09-29T16:56:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102676/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102676/",
   "title": "CVE-2026-102676 fixed upstream (npm)",
   "content_text": "Fixed versions: electron 41.10.6, electron 42.9.2, electron 43.4.1, electron 44.0.0-beta.5.",
   "date_published": "2026-09-29T16:56:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102675/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102675/",
   "title": "CVE-2026-102675 disclosed",
   "content_text": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.",
   "date_published": "2026-09-29T16:54:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102675/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102675/",
   "title": "CVE-2026-102675 fixed upstream (npm)",
   "content_text": "Fixed versions: electron 41.10.6, electron 42.9.2, electron 43.4.1, electron 44.0.0-beta.5.",
   "date_published": "2026-09-29T16:54:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102674/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102674/",
   "title": "CVE-2026-102674 disclosed",
   "content_text": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.",
   "date_published": "2026-09-29T16:51:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102674/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102674/",
   "title": "CVE-2026-102674 fixed upstream (npm)",
   "content_text": "Fixed versions: electron 41.10.6, electron 42.9.2, electron 43.4.1, electron 44.0.0-beta.5.",
   "date_published": "2026-09-29T16:51:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102673/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102673/",
   "title": "CVE-2026-102673 disclosed",
   "content_text": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.",
   "date_published": "2026-09-29T16:38:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102673/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102673/",
   "title": "CVE-2026-102673 fixed upstream (npm)",
   "content_text": "Fixed versions: electron 41.10.4, electron 42.5.2, electron 43.0.0.",
   "date_published": "2026-09-29T16:38:41Z"
  }
 ]
}