CVE-2026-102676
Critical
9.8 CVSS v3.1
- Published
- Sep 29, 2026
- Updated
- Oct 15, 2026
- Vendor
- Electronjs
- Affected versions
- See affected products
- Weakness
- CWE-269, CWE-1188
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Severity
Critical (9.8)CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
- Electronjs Electron < 41.10.6
- Electronjs Electron >= 42.0.0, < 42.9.2
- Electronjs Electron >= 43.0.0, < 43.4.1
- Electronjs Electron 44.0.0
Exploitation status
Unknown
Technical details
Technical analysis has not been written for this record yet.
Mitigation & remediation
Follow the vendor advisory linked below for patches and workarounds.