Cyber Posture

CVE-2026-34774

High

Published: 04 April 2026

Published
04 April 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 5.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-34774 is a high-severity Use After Free (CWE-416) vulnerability in Electronjs Electron. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 5.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely remediation through patching Electron to versions 39.8.1, 40.7.0, or 41.0.0 directly eliminates the use-after-free vulnerability in offscreen WebContents handling.

prevent

Configuration settings that disable offscreen rendering (webPreferences.offscreen: false) or deny child windows via setWindowOpenHandler prevent the vulnerable conditions from occurring.

prevent

Memory protection mechanisms such as ASLR and DEP mitigate exploitation of the use-after-free by complicating reliable dereferencing of freed memory in child window paint frames.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free memory corruption in Electron client framework enables exploitation for code execution in desktop applications (high C/I/A impact).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the…

more

parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference freed memory, which may lead to a crash or memory corruption. Apps are only affected if they use offscreen rendering (webPreferences.offscreen: true) and their setWindowOpenHandler permits child windows. Apps that do not use offscreen rendering, or that deny child windows, are not affected. This issue has been patched in versions 39.8.1, 40.7.0, and 41.0.0.

Deeper analysisAI

CVE-2026-34774 is a use-after-free vulnerability (CWE-416) in the Electron framework, used for building cross-platform desktop applications with JavaScript, HTML, and CSS. It affects Electron versions prior to 39.8.1, 40.7.0, and 41.0.0, but only applications that enable offscreen rendering via webPreferences.offscreen: true and permit child windows through their setWindowOpenHandler implementation allowing window.open().

The vulnerability arises when a parent offscreen WebContents is destroyed while a child window opened via window.open() remains active, causing subsequent paint frames on the child to dereference freed memory and potentially lead to a crash or memory corruption. Exploitation requires network access (AV:N) with no privileges (PR:N) or user interaction (UI:N), but high attack complexity (AC:H), yielding a CVSS 3.1 score of 8.1 with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). Any remote attacker able to influence app behavior under these specific conditions could trigger it.

The Electron security advisory (GHSA-532v-xpq5-8h95) at https://github.com/electron/electron/security/advisories/GHSA-532v-xpq5-8h95 confirms the issue and states that it has been addressed in versions 39.8.1, 40.7.0, and 41.0.0. Applications not using offscreen rendering or denying child windows are unaffected; practitioners should verify and update Electron-based apps to these versions for mitigation.

Details

CWE(s)

Affected Products

electronjs
electron
41.0.0 · ≤ 39.8.1 · 40.0.0 — 40.7.0

CVEs Like This One

CVE-2026-34770Same product: Electronjs Electron
CVE-2026-34771Same product: Electronjs Electron
CVE-2026-34772Same product: Electronjs Electron
CVE-2026-34769Same product: Electronjs Electron
CVE-2026-34775Same product: Electronjs Electron
CVE-2026-34765Same product: Electronjs Electron
CVE-2026-34773Same product: Electronjs Electron
CVE-2026-34768Same product: Electronjs Electron
CVE-2026-34780Same product: Electronjs Electron
CVE-2026-34779Same product: Electronjs Electron

References