CVE-2026-102676
Published:September 29, 2026
Updated:October 10, 2026
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Affected Packages
https://github.com/electron/electron.git (GITHUB):
Affected version(s) >=v44.0.0-alpha.1 <v44.0.0-beta.5Fix Suggestion:
Update to version v44.0.0-beta.5https://github.com/electron/electron.git (GITHUB):
Affected version(s) >=v42.0.0-alpha.1 <v42.9.2Fix Suggestion:
Update to version v42.9.2https://github.com/electron/electron.git (GITHUB):
Affected version(s) >=v43.0.0-alpha.1 <v43.4.1Fix Suggestion:
Update to version v43.4.1https://github.com/electron/electron.git (GITHUB):
Affected version(s) >=v41.0.0-alpha.1 <v41.10.6Fix Suggestion:
Update to version v41.10.6electron (NPM):
Affected version(s) >=44.0.0-alpha.1 <44.0.0-beta.5Fix Suggestion:
Update to version 44.0.0-beta.5electron (NPM):
Affected version(s) >=43.0.0-alpha.1 <43.4.1Fix Suggestion:
Update to version 43.4.1electron (NPM):
Affected version(s) >=42.0.0-alpha.1 <42.9.2Fix Suggestion:
Update to version 42.9.2electron (NPM):
Affected version(s) >=0.1.0 <41.10.6Fix Suggestion:
Update to version 41.10.6Related Resources (12)
Do you need more information?
Contact UsCVSS v4
Base Score:
9
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
CVSS v3
Base Score:
8.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
EPSS
Base Score:
0.45