CVE-2026-34774
Use-After-Free in Electron Offscreen Rendering Causes Memory Corruption
Publication date: 2026-04-04
Last updated on: 2026-04-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | 41.0.0 |
| electronjs | electron | From 40.0.0 (inc) to 40.7.0 (exc) |
| electronjs | electron | 41.0.0 |
| electronjs | electron | to 39.8.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-34774 is a use-after-free vulnerability in the Electron framework that affects applications using offscreen rendering with child windows created via window.open().
If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint operations on the child window access memory that has already been freed. This can cause the application to crash or experience memory corruption.
Only apps that enable offscreen rendering (by setting webPreferences.offscreen: true) and allow child windows through their setWindowOpenHandler are affected. Apps that do not use offscreen rendering or that block child window creation are not vulnerable.
The issue has been fixed in Electron versions 39.8.1, 40.7.0, and 41.0.0.
How can this vulnerability impact me? :
This vulnerability can lead to application crashes or memory corruption due to use-after-free errors when offscreen rendering and child windows are used improperly.
Because the vulnerability has a high CVSS score (8.1) with high impacts on confidentiality, integrity, and availability, it could potentially be exploited remotely without user interaction, leading to severe consequences such as data corruption, application instability, or denial of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs in Electron applications that use offscreen rendering with child windows created via window.open(). Detection involves identifying if your application uses the webPreferences.offscreen: true setting and permits child windows through setWindowOpenHandler.
Since this is a use-after-free vulnerability leading to crashes or memory corruption, monitoring application logs for crashes or unusual behavior related to rendering child windows can help detect exploitation attempts.
There are no specific network commands provided to detect this vulnerability directly, as it is related to application behavior and memory management.
Suggested steps include checking the Electron version used by your applications to see if it is prior to the patched versions (39.8.1, 40.7.0, 41.0.0). You can run commands to check the Electron version, for example:
- In a terminal, run `electron --version` or check the package.json dependencies for the Electron version.
- Review application source code or configuration files for `webPreferences.offscreen` set to true and usage of `setWindowOpenHandler` allowing child windows.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating Electron to a patched version: 39.8.1, 40.7.0, or 41.0.0 or later.
If updating is not immediately possible, you can apply workarounds such as:
- Deny child window creation from offscreen renderers by modifying the `setWindowOpenHandler` to block or prevent child windows.
- Ensure that all child windows are closed before the parent offscreen WebContents is destroyed to avoid use-after-free conditions.