Electron up to 42.9.x/43.4.x/44.0.0-beta.5 Sandboxed Preload Code Cache input validation

Summaryinfo

A vulnerability identified as problematic has been detected in Electron up to 42.9.x/43.4.x/44.0.0-beta.5. This impacts an unknown function of the component Sandboxed Preload Code Cache. Performing a manipulation results in input validation. This vulnerability is identified as CVE-2026-102677. The attack is only possible with local access. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Electron up to 42.9.x/43.4.x/44.0.0-beta.5. This affects some unknown functionality of the component Sandboxed Preload Code Cache. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-102677 since 09/29/2026. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 42.10.0, 43.5.0 or 44.0.0-beta.6 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Electron

Version

• 42.0
• 42.1
• 42.2
• 42.3
• 42.4
• 42.5
• 42.6
• 42.7
• 42.8
• 42.9
• 43.0
• 43.1
• 43.2
• 43.3
• 43.4
• 44.0.0-beta.0
• 44.0.0-beta.1
• 44.0.0-beta.2
• 44.0.0-beta.3
• 44.0.0-beta.4
• 44.0.0-beta.5

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion