Packages / electron / Security

LowVulnerabilityGHSA-8x5q-pvf5-64mpCVE-2026-34764Published 3 Apr 2026

Electron: Use-after-free in offscreen shared texture release() callback

Affected releases · electron

  • 41.x41.0.0 – 41.0.4Fixed in 41.1.0
  • 40.x40.0.0 – 40.8.4Fixed in 40.8.5
  • 39.x39.0.0 – 39.8.4Fixed in 39.8.5
  • 38.x38.0.0 – 38.8.6No fix on this line yet
  • 37.x37.0.0 – 37.10.3No fix on this line yet
  • 36.x and older33.0.0 – 36.9.5No fix, no longer updated

On 41.x, the newest line:

npm install electron@41.1.0
45.x

  1. Not affected

    45.0.0

    1 release, latest

41.x

  1. Affected

    41.0.0 – 41.0.4

    5 releases

  2. Fixed

    41.1.0 – 41.10.7

    27 releases

40.x

  1. Affected

    40.0.0 – 40.8.4

    15 releases

  2. Fixed

    40.8.5 – 40.10.6

    11 releases

39.x

  1. Affected

    39.0.0 – 39.8.4

    25 releases

  2. Fixed

    39.8.5 – 39.8.10

    6 releases

38.x

  1. Affected

    38.0.0 – 38.8.6

    19 releases

37.x

  1. Affected

    37.0.0 – 37.10.3

    24 releases

36.x

  1. Affected

    36.0.0 – 36.9.5

    23 releases

35.x

  1. Affected

    35.0.0 – 35.7.5

    22 releases

34.x

  1. Affected

    34.0.0 – 34.5.8

    22 releases

33.x

  1. Affected

    33.0.0 – 33.4.11

    21 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

Apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and invoking it after that point dereferences freed memory in the main process, which may lead to a crash or memory corruption.

Apps are only affected if they use offscreen rendering with webPreferences.offscreen: { useSharedTexture: true }. Apps that do not enable shared-texture offscreen rendering are not affected.

Workarounds

Ensure texture.release() is called promptly after the texture has been consumed, before the texture object becomes unreachable.

Fixed Versions

  • 42.0.0-alpha.5

  • 41.1.0

  • 40.8.5

  • 39.8.5

For more information

If there are any questions or comments about this advisory, send an email to security@electronjs.org