CVE Tools
Track your stack

Electron

80 CVEs tracked. 3 of them are in CISA KEV.

This hub aggregates every CVE we track for Electron, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Electron CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Electron CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-072
2025-080
2025-091
2025-100
2025-110
2025-120
2026-011
2026-020
2026-030
2026-0418
2026-050
2026-061
2026-070
2026-0816
2026-095
2026-109

Severity

How the 80 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical23%
  • High2937%
  • Medium3747%
  • Low1114%

Latest CVEs

The 15 most recently published vulnerabilities affecting Electron.

  1. CVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificates7.4
  2. CVE-2026-114124Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry3.9
  3. CVE-2026-114122Electron: Frame subscription trusts GPU-supplied frame geometry3.9
  4. CVE-2026-114121Electron: openExternal permission requests can be attributed to the wrong origin5.4
  5. CVE-2026-113800Electron: HID and USB permission checks can be attributed to the wrong origin5.4
  6. CVE-2026-113798Electron: Pointer lock permission requests can be attributed to the wrong frame5.4
  7. CVE-2026-113797Electron: Extension tabs.query returns tab URLs and titles without the tabs permission3.1
  8. CVE-2026-113796Electron: SameSite cookie restrictions are not applied to windows opened from links4.2
  9. CVE-2026-102672Electron: Local race condition in Squirrel.Mac update installation on macOS6.7
  10. CVE-2026-102677Electron: Sandboxed preload code cache can be poisoned by a compromised renderer7.8
  11. CVE-2026-102676Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions8.3
  12. CVE-2026-102675Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled7.4
  13. CVE-2026-102674Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions8.2
  14. CVE-2026-102673Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab8.2
  15. CVE-2026-70612Electron: Sandboxed iframes can launch external protocol handlers5.4

Product grouping is registry-driven, with AI assist and human review. How it works