CVE-2026-70598
Received Received - Intake

Memory Corruption in Electron Framework

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70598
EUVD
EUVD-2026-53420

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.10 (exc)
electron electron to 40.9.0 (exc)
electron electron to 41.2.1 (exc)
electron electron to 42.0.0-beta.3 (exc)
electron electron to 39.8.10|end_excluding=40.9.0|end_excluding=41.2.1|end_excluding=42.0.0-beta.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Electron, a framework for building desktop apps with JavaScript, HTML, and CSS. It involves improper validation of frame data from the GPU process in versions before 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3. A compromised GPU process could cause the main process to read out-of-bounds memory while creating paint event images, potentially exposing sensitive data or crashing the app.

Detection Guidance

To detect this vulnerability, check if your Electron application uses off-screen rendering by verifying the `webPreferences.offscreen` setting in your app's configuration. If enabled, inspect the Electron version against the patched versions (39.8.10, 40.9.0, 41.2.1, or 42.0.0-beta.3). Use commands like `electron --version` to check the version.

Impact Analysis

If you use an affected Electron version with off-screen rendering enabled, a compromised GPU process could expose sensitive memory or crash your application. Only apps using off-screen rendering (via webPreferences.offscreen) are affected. Others remain safe.

Mitigation Strategies

Immediately update Electron to a patched version (39.8.10, 40.9.0, 41.2.1, or 42.0.0-beta.3). If using off-screen rendering, disable it via `webPreferences.offscreen: false` if not required. Monitor for crashes or memory leaks in applications using Electron.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70598. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart