On 29 September 2026, Electron published two security advisories. CVE-2026-102675 lets responses from certain custom protocol handlers be read across origins, and it finishes the fix for an August bug, CVE-2026-70604. CVE-2026-102677 lets a compromised renderer poison the sandboxed preload code cache and run its code in the more privileged preload context.
Both are fixed in current releases. The harder question for teams shipping Electron apps is how to keep up with the Chromium side. Through September and October, Electron 44 shipped on Chromium 152 while desktop Chrome moved to 155, and Electron's release notes describe Chromium security work as "Backported fixes" without listing CVE IDs.
What's affected
CVE-2026-102675 (GHSA-j84w-jfhq-vhvj, CVSS 7.4). Affects apps that register a custom scheme with supportFetchAPI enabled but corsEnabled disabled, serve it through protocol.registerFileProtocol or protocol.registerHttpProtocol, and load untrusted content in the same session. Fixed in 41.10.6, 42.9.2, 43.4.1 and 44.0.0-beta.5.
CVE-2026-102677 (GHSA-qmv3-fv6v-rmhq, CVSS 7.8). Electron's sandboxed preload code cache "did not verify that a cached entry matched the preload it was served for." Affects versions from 42.3.3 up to the fixes in 42.10.0, 43.5.0 and 44.0.0-beta.6, and only matters for apps that load untrusted content.
Chromium baselines. Electron supports the latest three stable majors. Here is what each shipped during the window, from Electron's release index:
| Line | Latest release (date) | Chromium |
|---|---|---|
| 44 | 44.9.0 (17 Oct) | 152.0.7977.167 |
| 43 | 43.8.0 (16 Oct) | 150.0.7871.250 |
| 42 | 42.11.15 (15 Oct) | 148.0.7778.280 |
The 43 and 42 lines kept the same Chromium version string for every release since 31 August. Security fixes still land in those lines, as backports. The 44.x release notes alone carry "Backported fixes from upstream" entries in eight releases between 4 September and 15 October, covering ANGLE, Chromium, Dawn, PDFium, Skia, V8 and WebRTC.
Several 44.x releases also fixed Electron's own security-relevant behavior:
- 44.1.1:
chrome.tabs.query()returned tab URLs and titles to extensions without thetabspermission or host access. - 44.3.0: File System Access grants are now scoped to the requesting document and reset when the origin's last page closes.
- 44.4.0: Fixed the browser-side check that blocks drag and drop between cross-site frames of the same page, which had been disabled.
- 44.9.0: Fixed link-opened windows not using the opener's session and
webPreferences. Also fixed in 42, 43 and 45.
How to check if you're exposed
Find the Electron version each app builds with:
npm ls electron
# or, in a monorepo
grep -rn '"electron":' --include=package.json . | grep -v node_modules
Inside a running app, log the real runtime versions:
console.log(process.versions.electron, process.versions.chrome);
Then look for the risky pattern behind CVE-2026-102675:
grep -rnE "registerSchemesAsPrivileged|supportFetchAPI|corsEnabled|registerFileProtocol|registerHttpProtocol" src/ app/ 2>/dev/null
If a scheme has supportFetchAPI: true without corsEnabled: true, and any window in that session loads remote content, you are in the affected configuration until you upgrade.
What to do now
- Upgrade to the latest patch of a supported line: 44.9.0, 43.8.0 or 42.11.15 as of 17 October. All three are past both advisories' fixed versions.
- Move off Electron 41 and older. Only the latest three majors get backports.
- Separate sessions. Load remote or untrusted content in its own
sessionpartition, never the one that serves privileged custom schemes. - Prefer
protocol.handleoverregisterFileProtocolandregisterHttpProtocol, which Electron's docs mark as deprecated since version 25, and register schemes with only the privileges they need. - Ship on a schedule. Chromium backports arrive roughly weekly. An app that releases quarterly is carrying months of known browser bugs.
You can drop a package.json into the free scan at gold.safeguard.sh/scan to see your Electron version and any advisories against it. It runs in your browser and the file never leaves your machine.
Why it matters
An Electron app is a browser you ship, plus Node.js, plus your own IPC surface. The Chromium version string is a weak signal of patch status, because Electron backports fixes without bumping it. A check that compares process.versions.chrome against Chrome advisories will flag bugs that Electron has already backported. The Electron release number is the thing to track.
The two September advisories are also a reminder that most Electron risk is configuration. Both only matter when untrusted content runs next to privileged features. Keeping those apart is a design decision you make once, and it limits the damage of the next bug.
Try it yourself
Pick one Electron app you ship. Record its Electron version, its Chromium version, and the date of that Electron release. Then list every session it creates and what content each one loads. Mark any session that mixes remote pages with custom schemes or a preload that exposes Node features.
Click through it at your own pace, or open it full screen.
Quick check
Your app runs Electron 43.8.0, which reports Chromium 150.0.7871.250. Is it missing three months of Chromium fixes?
Not necessarily. Electron backports Chromium security fixes into supported lines without changing the Chromium version string. Track the Electron release, not the Chromium number.
Which configuration does CVE-2026-102675 need?
A custom scheme registered with supportFetchAPI enabled and corsEnabled disabled, served by registerFileProtocol or registerHttpProtocol, with untrusted content loaded in the same session.
Is an app on Electron 42.2.0 affected by CVE-2026-102677?
No. The advisory says the issue was introduced in 42.3.3. But 42.2.0 is still affected by CVE-2026-102675, which was fixed in 42.9.2, so upgrade anyway.
