Packages / electron / Security

HighVulnerabilityGHSA-qmv3-fv6v-rmhqCVE-2026-102677Published 29 Sep 2026

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

Affected releases · electron

  • 43.x43.0.0 – 43.4.1Fixed in 43.5.0
  • 42.x42.3.3 – 42.9.3Fixed in 42.10.0

On 43.x, the newest line:

npm install electron@43.5.0
45.x

  1. Not affected

    45.0.0

    1 release, latest

43.x

  1. Affected

    43.0.0 – 43.4.1

    7 releases

  2. Fixed

    43.5.0 – 43.8.3

    19 releases

42.x

  1. Not affected

    42.0.0 – 42.3.2

    7 releases

  2. Affected

    42.3.3 – 42.9.3

    17 releases

  3. Fixed

    42.10.0 – 42.11.18

    21 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

The cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load.

Apps are only affected if they load untrusted content. Apps that do not load untrusted content are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

  • 44.0.0-beta.6

  • 43.5.0

  • 42.10.0

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org