CVE-2026-102677: Electron Sandbox Preload Code Cache Vulnerability
Summary
CVE-2026-102677: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer. Affects electron across 3 version ranges.
>= 42.3.3, < 42.10.0
>= 43.0.0-beta.1, < 43.5.0
>= 44.0.0-alpha.1, < 44.0.0-beta.6
Fixed in 42.10.0, 43.5.0 or 44.0.0-beta.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is a popular framework that enables developers to build cross-platform desktop applications using web technologies like JavaScript, HTML, and CSS. It provides a rich set of APIs to interact with the native operating system, allowing for seamless integration of web applications with desktop functionalities. However, Electron's handling of sandboxed preload scripts has a critical vulnerability that can be exploited if untrusted content is loaded, potentially compromising the security of applications.
Vulnerability Detail
The vulnerability arises from Electron's cache mechanism for sandboxed preload scripts, which fails to verify that a cached entry corresponds to the preload it was intended for. This flaw allows a compromised renderer to execute arbitrary code in the preload context during subsequent loads. The implications of this vulnerability are severe, as it could lead to unauthorized access and manipulation of application data, especially in applications that load untrusted content.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 42.3.3, < 42.10.042.10.0npm install electron@42.10.0 -
>= 43.0.0-beta.1, < 43.5.043.5.0npm install electron@43.5.0 -
>= 44.0.0-alpha.1, < 44.0.0-beta.644.0.0-beta.6npm install electron@44.0.0-beta.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no application-side workarounds available. The only effective measure is to update to a patched version of Electron.
Conclusion
In summary, CVE-2026-102677 is a significant vulnerability in Electron that can lead to severe security risks for applications loading untrusted content. The only effective solution is to update to the patched versions of Electron. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for electron →
FAQ
CVE-2026-102677 is a vulnerability in Electron that allows a compromised renderer to poison the cache for sandboxed preload scripts, potentially executing malicious code.
Applications that load untrusted content using Electron are at risk. Apps that do not load untrusted content are not affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 7.8, indicating a high severity level.
While there are no workarounds available, it is crucial to prioritize updating Electron to a patched version as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
