{"id":"GHSA-qmv3-fv6v-rmhq","summary":"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer","details":"### Impact\n\nThe cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load.\n\nApps are only affected if they load untrusted content. Apps that do not load untrusted content are not affected.\n\n### Workarounds\n\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n\n* `44.0.0-beta.6`\n* `43.5.0 `\n* `42.10.0`\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","aliases":["CVE-2026-102677"],"modified":"2026-09-29T18:15:05.571919148Z","published":"2026-09-29T18:02:01Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-20","CWE-345"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-09-29T18:02:01Z"},"references":[{"type":"WEB","url":"https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq"},{"type":"WEB","url":"https://github.com/electron/electron/pull/52480"},{"type":"WEB","url":"https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601"},{"type":"WEB","url":"https://github.com/electron/electron/commit/06a12a87a23f40abbf580fc7a552bc1189812c45"},{"type":"WEB","url":"https://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3"},{"type":"WEB","url":"https://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217"},{"type":"PACKAGE","url":"https://github.com/electron/electron"},{"type":"WEB","url":"https://github.com/electron/electron/releases/tag/v42.10.0"},{"type":"WEB","url":"https://github.com/electron/electron/releases/tag/v43.5.0"},{"type":"WEB","url":"https://github.com/electron/electron/releases/tag/v44.0.0-beta.6"}],"affected":[{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"42.3.3"},{"fixed":"42.10.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qmv3-fv6v-rmhq/GHSA-qmv3-fv6v-rmhq.json"}},{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"43.0.0-beta.1"},{"fixed":"43.5.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qmv3-fv6v-rmhq/GHSA-qmv3-fv6v-rmhq.json"}},{"package":{"name":"electron","ecosystem":"npm","purl":"pkg:npm/electron"},"ranges":[{"type":"SEMVER","events":[{"introduced":"44.0.0-alpha.1"},{"fixed":"44.0.0-beta.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qmv3-fv6v-rmhq/GHSA-qmv3-fv6v-rmhq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}