{"id":"EUVD-2026-89179","enisaUuid":"4dfac998-dd66-3b75-8994-3e9e710312f7","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron\u0027s sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer\u0027s code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.","datePublished":"Sep 29, 2026, 5:43:26 PM","dateUpdated":"Oct 2, 2026, 12:18:18 PM","baseScore":7.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq\nhttps://github.com/electron/electron/pull/52480\nhttps://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601\nhttps://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3\nhttps://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217\nhttps://github.com/electron/electron/releases/tag/v42.10.0\nhttps://github.com/electron/electron/releases/tag/v43.5.0\nhttps://github.com/electron/electron/releases/tag/v44.0.0-beta.6\n","aliases":"CVE-2026-102677\nGHSA-qmv3-fv6v-rmhq\n","assigner":"GitHub_M","epss":0.1,"enisaIdProduct":[{"id":"09568fb6-e1bf-3e51-a9e5-db14a9f5735f","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"44.0.0-alpha.1, \u003c 44.0.0-beta.6"},{"id":"1930502a-3424-3b4c-9e69-4b13f2376d0a","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.3.3, \u003c 42.10.0"},{"id":"631dd6c1-8969-3669-8b63-c4ee90cf2c1d","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"43.0.0-beta.1, \u003c 43.5.0"}],"enisaIdVendor":[{"id":"e44566ba-3e6a-3ab8-b0e4-89c540068cd5","vendor":{"name":"electron"}}],"enisaIdVulnerability":[{"id":"eeb77be7-1227-30ad-bb59-740b0df6723e","vulnerability":{"id":"CVE-2026-102677","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron\u0027s sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer\u0027s code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.","datePublished":"Sep 29, 2026, 5:43:26 PM","dateUpdated":"Oct 2, 2026, 12:18:18 PM","status":"PUBLISHED","baseScore":7.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq\nhttps://github.com/electron/electron/pull/52480\nhttps://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601\nhttps://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3\nhttps://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217\nhttps://github.com/electron/electron/releases/tag/v42.10.0\nhttps://github.com/electron/electron/releases/tag/v43.5.0\nhttps://github.com/electron/electron/releases/tag/v44.0.0-beta.6\n","enisa_id":"EUVD-2026-89179\n","assigner":"GitHub_M","epss":0.1,"dataProcessed":"Oct 27, 2026, 7:15:40 AM","vulnerabilityProduct":[{"id":"542b86e2-c05b-3051-9ed8-e310e750cda5","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"43.0.0-beta.1, \u003c 43.5.0"},{"id":"7b7326c0-21cc-3d64-ba88-b29cba25ed2f","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"44.0.0-alpha.1, \u003c 44.0.0-beta.6"},{"id":"ee1c06ae-b33f-3e20-8e5f-45ec633639c5","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.3.3, \u003c 42.10.0"}],"vulnerabilityVendor":[{"id":"e5b1cfb6-d0e2-3bf9-8d68-5fbec222a95e","vendor":{"name":"electron"}}]}},{"id":"fd9ac63f-1bc0-3214-ac26-361583f7f60f","vulnerability":{"id":"GHSA-qmv3-fv6v-rmhq","description":"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer","datePublished":"Sep 29, 2026, 6:02:01 PM","dateUpdated":"Sep 29, 2026, 6:02:01 PM","baseScore":0.0,"references":"https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq\nhttps://github.com/electron/electron/pull/52480\nhttps://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601\nhttps://github.com/electron/electron/commit/06a12a87a23f40abbf580fc7a552bc1189812c45\nhttps://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3\nhttps://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217\nhttps://github.com/electron/electron\nhttps://github.com/electron/electron/releases/tag/v42.10.0\nhttps://github.com/electron/electron/releases/tag/v43.5.0\nhttps://github.com/electron/electron/releases/tag/v44.0.0-beta.6\n","enisa_id":"EUVD-2026-89179\n","aliases":"GHSA-qmv3-fv6v-rmhq\nCVE-2026-102677\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}