{"id":"CVE-2026-102677","aliases":["GHSA-qmv3-fv6v-rmhq"],"url":"https://o3.security/vulnerability/CVE-2026-102677","summary":"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer","details":"### Impact\n\nThe cache Electron keeps for sandboxed preload scripts did not verify that a cached entry matched the preload it was served for. A compromised renderer could use this to run its own code in the preload context on a later load.\n\nApps are only affected if they load untrusted content. Apps that do not load untrusted content are not affected.\n\n### Workarounds\n\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n\n* `44.0.0-beta.6`\n* `43.5.0 `\n* `42.10.0`\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","published":"2026-09-29T17:43:26.960Z","modified":"2026-10-04T07:04:37.729357Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"electron","fixedVersion":"42.10.0"},{"ecosystem":"npm","name":"electron","fixedVersion":"43.5.0"},{"ecosystem":"npm","name":"electron","fixedVersion":"44.0.0-beta.6"}],"fix":{"url":"https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601","label":"electron/electron@000453e"},"references":[{"type":"WEB","url":"https://github.com/electron/electron/releases/tag/v42.10.0"},{"type":"WEB","url":"https://github.com/electron/electron/releases/tag/v43.5.0"},{"type":"WEB","url":"https://github.com/electron/electron/releases/tag/v44.0.0-beta.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102677.json"},{"type":"ADVISORY","url":"https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102677"},{"type":"FIX","url":"https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601"},{"type":"FIX","url":"https://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3"},{"type":"FIX","url":"https://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217"},{"type":"FIX","url":"https://github.com/electron/electron/pull/52480"},{"type":"WEB","url":"https://github.com/electron/electron/commit/06a12a87a23f40abbf580fc7a552bc1189812c45"},{"type":"PACKAGE","url":"https://github.com/electron/electron"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-04T07:04:37.729357Z"}}