Vendor
Electron
74 known vulnerabilities in products by Electron, 0 of them actively exploited (CISA KEV).
Key figures
74
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2017-12581 | Electron: security vulnerability | 8.1 | |
| Critical | CVE-2026-102676 | Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions | 8.3 | |
| High | CVE-2020-15174 | Unpreventable top-level navigation in Electron | 7.5 | |
| Critical | CVE-2026-54257 | Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow | — | |
| Medium | CVE-2020-26272 | Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs | 5.4 | |
| High | CVE-2026-115570 | Electron: Mitigation for compromised eMudhra intermediate certificates | 7.4 | |
| High | CVE-2026-102674 | Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions | 8.2 | |
| High | CVE-2020-4075 | Arbitrary file read via window-open IPC in Electron | 6.8 | |
| High | CVE-2026-54673 | Electron-userland Electron-builder: Exposure of Sensitive Information to an Unauthorized Actor | 6.5 | |
| Critical | CVE-2020-4077 | Context isolation bypass via contextBridge in Electron | 7.7 | |
| High | CVE-2026-102673 | Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab | 8.2 | |
| High | CVE-2026-70608 | Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path | 7.2 | |
| High | CVE-2026-34774 | Electron: Use-after-free in offscreen child window paint callback | 8.1 | |
| High | CVE-2026-102677 | Electron: Sandboxed preload code cache can be poisoned by a compromised renderer | 7.8 | |
| High | CVE-2026-102675 | Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled | 7.4 | |
| High | CVE-2021-39184 | Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API | 6.8 | |
| Medium | CVE-2026-70609 | Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter | 5.7 | |
| Medium | CVE-2026-70610 | Electron: contextBridge object copy honors prototype setters | 5.4 | |
| High | CVE-2026-70604 | Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads | 7.4 | |
| Medium | CVE-2026-70607 | Electron: window.open features string controls some window options considered privileged | 5.3 | |
| Low | CVE-2026-113797 | Electron: Extension tabs.query returns tab URLs and titles without the tabs permission | 3.1 | |
| Medium | CVE-2026-102672 | Electron: Local race condition in Squirrel.Mac update installation on macOS | 6.7 | |
| High | CVE-2026-34780 | Electron: Context Isolation bypass via contextBridge VideoFrame transfer | 8.4 | |
| High | CVE-2026-70601 | Electron: Context isolation bypass via Function.prototype.bind hijack | 7.5 | |
| High | CVE-2022-29257 | Electron's AutoUpdater module fails to validate certain nested components of the bundle | 6.6 |
Products
| Electron | 69 | 0 |
| Electron electron-builder | 4 | 0 |