CVE-2026-114124: Electron off-screen rendering on macOS can read out-of-bounds memory
Summary
CVE-2026-114124: A compromised GPU process can trigger out-of-bounds memory reads, potentially disclosing application memory or crashing the app. Affects electron across 4 version ranges.
< 42.11.6
>= 43.0.0-alpha.1, < 43.7.3
>= 44.0.0-alpha.1, < 44.4.3
>= 45.0.0-alpha.1, < 45.0.0-alpha.9
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is a JavaScript desktop application framework in the npm ecosystem. It lets developers build desktop applications using web technologies. Applications can use off-screen rendering to produce images through paint events; this advisory concerns that rendering mode on macOS.
Vulnerability Detail
A compromised GPU process can cause Electron’s main process to read out-of-bounds memory while producing paint event images. The vulnerability is an out-of-bounds read (CWE-125): frame data received from the GPU process was not fully validated. The impact can include memory disclosure or an application crash. Exposure requires an app to use webPreferences.offscreen on macOS and an attacker to have separately gained code execution in the GPU process; apps without off-screen rendering are not affected.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 42.11.642.11.6npm install electron@42.11.6 -
>= 43.0.0-alpha.1, < 43.7.343.7.3npm install electron@43.7.3 -
>= 44.0.0-alpha.1, < 44.4.344.4.3npm install electron@44.4.3 -
>= 45.0.0-alpha.1, < 45.0.0-alpha.945.0.0-alpha.9npm install electron@45.0.0-alpha.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Documented workaround: Electron has no app-side workaround for this issue. Update Electron to a patched version; restricting off-screen rendering is not documented as a workaround.
Conclusion
Upgrade Electron to the minimum fixed version for your release line: 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9. The issue applies to macOS apps using off-screen rendering when an attacker has separately compromised the GPU process. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for electron →
FAQ
Electron versions before 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9 in their respective release lines are affected.
CVE-2026-114124 can let a compromised GPU process trigger out-of-bounds reads, disclosing memory or crashing an affected Electron app.
Upgrade Electron to the minimum fixed version for its release line: 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9.
Electron has no documented app-side workaround; the advisory requires updating to a patched version.
Check package-lock.json manually for Electron and its resolved version. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
