CVE-2026-102676: electron Improper Privilege Management
Vulnerability summary
CVE-2026-102676 is a critical (CVSS 9.8) Improper Privilege Management vulnerability in electron. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities.
Timeline
- 29-09-2026PublishedVulnerability first disclosed.
- 29-09-2026Last modifiedVulnerability information updated.
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA8.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HDiffers
- OSV · NpmEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-1188Initialization of a Resource with an Insecure DefaultThe product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
Affected systems
Electron1 product
- electron< 41.10.6 | ≥ 42.0.0-alpha.1, < 42.9.2 | ≥ 43.0.0-alpha.1, < 43.4.1 | ≥ 44.0.0-alpha.1, < 44.0.0-beta.5
Electronjs1 product
- electron< 41.10.6 | ≥ 42.0.0, < 42.9.2 | ≥ 43.0.0, < 43.4.1 | 44.0.0:alpha1 | 44.0.0:alpha2 | 44.0.0:alpha3 | 44.0.0:alpha4 | 44.0.0:alpha5 | 44.0.0:alpha6 | 44.0.0:alpha7 | 44.0.0:alpha8 | 44.0.0:alpha9 | 44.0.0:beta1 | 44.0.0:beta2 | 44.0.0:beta3 | 44.0.0:beta4
Npm1 product
- electron< 41.10.6 | ≥ 42.0.0-alpha.1, < 42.9.2 | ≥ 43.0.0-alpha.1, < 43.4.1 | ≥ 44.0.0-alpha.1, < 44.0.0-beta.5
3 vendors · 3 products
References
10 links- github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366wX Refsource CONFIRMWEBVendor Advisory
- github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2X Refsource MISCWEBPatch
- github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671X Refsource MISCWEBPatch
- github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886X Refsource MISCWEBPatch
- github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233aeX Refsource MISCWEBPatch
- github.com/electron/electronPACKAGE