Cyber Posture

CVE-2026-34770

High

Published: 04 April 2026

Published
04 April 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0001 2.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34770 is a high-severity Use After Free (CWE-416) vulnerability in Electronjs Electron. Its CVSS base score is 7.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the use-after-free vulnerability by requiring timely identification, reporting, and patching of affected Electron versions to eliminate dangling references in the powerMonitor module.

prevent

Implements memory protection mechanisms such as ASLR or DEP to mitigate exploitation of the use-after-free leading to memory corruption or crashes from dereferenced OS resources.

detect

Enables vulnerability scanning to identify deployed Electron applications running vulnerable versions prior to 38.8.6, 39.8.1, 40.8.0, or 41.0.0-beta.8.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free in Electron client app framework leads to memory corruption exploitable for arbitrary code execution in client applications.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is…

more

garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.

Deeper analysisAI

CVE-2026-34770 is a use-after-free vulnerability (CWE-416) in the powerMonitor module of the Electron framework, which enables development of cross-platform desktop applications using JavaScript, HTML, and CSS. It affects Electron versions prior to 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8. The flaw occurs after the native PowerMonitor object is garbage-collected, as associated OS-level resources—such as a message window on Windows or a shutdown handler on macOS—retain dangling references. A subsequent session-change event on Windows or system shutdown on macOS can then dereference the freed memory, potentially leading to crashes or memory corruption. All Electron applications that access powerMonitor events, including suspend, resume, and lock-screen, are potentially affected, though the issue is not directly controllable from the renderer process.

With a CVSS v3.1 base score of 7.0 (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), exploitation requires local access, high attack complexity, no privileges, and user interaction. A local attacker could trigger the vulnerability through these conditions to achieve high impacts on confidentiality, integrity, and availability, such as via memory corruption or application crashes.

The Electron security advisory at https://github.com/electron/electron/security/advisories/GHSA-jjp3-mq3x-295m confirms the issue and states that it has been addressed in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8. Practitioners should update affected Electron-based applications to these patched versions or later to mitigate the risk.

Details

CWE(s)

Affected Products

electronjs
electron
41.0.0 · ≤ 38.8.6 · 39.0.0 — 39.8.1 · 40.0.0 — 40.8.0

CVEs Like This One

CVE-2026-34771Same product: Electronjs Electron
CVE-2026-34774Same product: Electronjs Electron
CVE-2026-34772Same product: Electronjs Electron
CVE-2026-34769Same product: Electronjs Electron
CVE-2026-34775Same product: Electronjs Electron
CVE-2026-34765Same product: Electronjs Electron
CVE-2026-34773Same product: Electronjs Electron
CVE-2026-34768Same product: Electronjs Electron
CVE-2026-34780Same product: Electronjs Electron
CVE-2026-34779Same product: Electronjs Electron

References