CVE-2026-102677 is a High (CVSS 7.8) flaw in Electron where the sandboxed preload code cache does not check that an entry matches its preload. A compromised renderer can run code in the privileged preload context. Fixed in 42.10.0, 43.5.0 and 44.0.0-beta.6.
What's affected
The weaknesses are CWE-20 (improper input validation) and CWE-345 (insufficient verification of data authenticity). The record says affected versions start at 42.3.3 and run until the fixed versions, which are 42.10.0, 43.5.0 and 44.0.0-beta.6.
The description is that Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker controlled cache data and cause Electron to reuse it on a later load. The renderer's code then runs in the more privileged preload context. The record adds that the issue affects applications that load untrusted content.
The vector is local, high attack complexity, low privileges, no user interaction, with a changed scope and high impact on all three measures. The changed scope reflects the crossing from the renderer boundary into the preload context.
The record's references include three commits, a pull request (52480) and release notes for the fixed versions. We read the v43.5.0 release page. The record does not mark the CVE as known exploited.
How to check if you're exposed
Check which Electron your app ships. In a project, run:
npm ls electron
Your lockfile shows the exact version that a build pinned. What matters is the version in the last build you shipped, not the one on developer machines.
Compare the version with the affected range, from 42.3.3 until the fixed versions. Then ask whether the app loads untrusted content, such as remote web pages, user supplied HTML, ads or third party widgets, since the record says that is the condition. An app that only loads its own bundled pages has a much smaller exposure, because a compromised renderer is the starting point.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Upgrade Electron to 42.10.0, 43.5.0 or 44.0.0-beta.6, or any later release, depending on your major version.
- Rebuild and release the app. A dependency bump does not reach users until a new build ships.
- Review which windows load remote or untrusted content, and keep those in sandboxed renderers with no node access.
- Keep preload scripts small and expose only narrow, validated functions through context isolation.
- Check that auto-update is working so that users reach the fixed build.
Why it matters
Electron separates renderer processes, which show web content, from more privileged preload scripts and the main process. A security bug that lets renderer content influence the preload context weakens the main defence of the framework. Here the route was a code cache that trusted its contents.
A compromised renderer is already a bad day, and this flaw lets it climb higher. That is why apps that load untrusted pages matter most. The fix is a version bump and a release, so the effort is mainly in shipping the new build.
Quick check
Does this affect apps that load only local content?
The record says it affects applications that load untrusted content. An app with only bundled, trusted pages needs a compromised renderer first, which is less likely. Upgrading is still sensible.
Which Electron versions fix it?
42.10.0, 43.5.0 and 44.0.0-beta.6, per the record.
Sources
- Electron release v43.5.0
- Electron release v42.10.0 (listed in the record)
- Electron pull request 52480
Last reviewed: 18 October 2026.
