CVE-2022-4135: Heap buffer overflow in GPU in electron
Summary
CVE-2022-4135: Heap buffer overflow in GPU. Affects electron versions >= 19.0.0, < 19.1.8. Fixed in 19.1.8. How to fix ↓
Also tracked for
- chromium · Debian:11
The same CVE-2022-4135 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is a popular framework for building cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It allows developers to create native-like applications for Windows, macOS, and Linux. The vulnerability identified as CVE-2022-4135 is a heap buffer overflow in the GPU component of Electron. This vulnerability affects versions prior to 107.0.5304.121 of Google Chrome, which is used as the underlying browser engine in Electron. The vulnerability could be exploited by a remote attacker who has compromised the renderer process, potentially leading to a sandbox escape through a crafted HTML page.
Vulnerability Detail
The heap buffer overflow vulnerability in the GPU component of Electron allows an attacker who has already compromised the renderer process to escape the sandbox and execute arbitrary code. By exploiting this vulnerability, an attacker could gain elevated privileges and perform unauthorized actions on the affected system. The vulnerability has been assigned a CVSS score of 9.6, indicating its critical severity.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
19.1.8
This is the first release that contains the fix.
npm install electron@19.1.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating Electron to the latest version.
Conclusion
The heap buffer overflow vulnerability in the GPU component of Electron poses a significant risk to the security of affected applications. It is crucial to update Electron to version 19.1.8 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for electron →
FAQ
Electron is a framework for building cross-platform desktop applications using web technologies.
The vulnerability allows a remote attacker to potentially escape the sandbox and execute arbitrary code.
Update Electron to version 19.1.8 or later to address the vulnerability.
No, there is no known workaround. Updating Electron is the recommended solution.
The CVSS score of this vulnerability is 9.6, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
