Electron up to 38.8.5/39.8.0/40.8.0/40.x Reply Message webContents.executeJavaScript authentication spoofing

Summaryinfo

A vulnerability described as critical has been identified in Electron up to 38.8.5/39.8.0/40.8.0/40.x. Affected by this vulnerability is the function webContents.executeJavaScript of the component Reply Message Handler. Executing a manipulation can lead to authentication spoofing. The identification of this vulnerability is CVE-2026-34778. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Electron up to 38.8.5/39.8.0/40.8.0/40.x and classified as critical. This vulnerability affects the function webContents.executeJavaScript of the component Reply Message Handler. The manipulation with an unknown input leads to a authentication spoofing vulnerability. The CWE definition for the vulnerability is CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

The advisory is available at github.com. This vulnerability was named CVE-2026-34778 since 03/30/2026. The exploitation appears to be difficult. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

Upgrading to version 38.8.6, 39.8.1, 40.8.1 or 41.0.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Electron

Version

• 38.8.0
• 38.8.1
• 38.8.2
• 38.8.3
• 38.8.4
• 38.8.5
• 39.0
• 39.1
• 39.2
• 39.3
• 39.4
• 39.5
• 39.6
• 39.7
• 39.8.0
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7
• 40.8.0
• 40.x

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion