Electron up to 39.7.x/40.6.x WebCodecs API contextBridge.exposeInMainWorld exposure of resource

Summaryinfo

A vulnerability identified as problematic has been detected in Electron up to 39.7.x/40.6.x. This vulnerability affects the function contextBridge.exposeInMainWorld of the component WebCodecs API. The manipulation leads to exposure of resource. This vulnerability is traded as CVE-2026-34780. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Electron up to 39.7.x/40.6.x. This issue affects the function contextBridge.exposeInMainWorld of the component WebCodecs API. The manipulation with an unknown input leads to a exposure of resource vulnerability. Using CWE to declare the problem leads to CWE-668. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-34780 since 03/30/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 39.8.0, 40.7.0 or 41.0.0-beta.8 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Electron

Version

• 39.0
• 39.1
• 39.2
• 39.3
• 39.4
• 39.5
• 39.6
• 39.7
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion