Auth bypass in Electron
CVE-2026-113797
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.
Vulnerability class: Broken Access Control
Published .
CVSS v3 metric
CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Electron — versions < 42.11.1, >= 43.0.0-alpha.1, < 43.5.1, >= 44.0.0-alpha.1, < 44.1.1
Weakness classification (CWE)
References
- github.com/electron/electron/security/advisories/GHSA-98mx-cjp9-gchm
- github.com/electron/electron/pull/52597
- github.com/electron/electron/pull/53353
- github.com/electron/electron/pull/53354
- github.com/electron/electron/pull/53355
- github.com/electron/electron/pull/53356
- github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4
- github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c
- github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f
- github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921
Frequently asked questions
- What is CVE-2026-113797?
- CVE-2026-113797 is a low-severity vulnerability in Electron, classified under Missing Authorization. CVSS score: 3.1/10. Published 2026-10-21.
- How severe is CVE-2026-113797?
- Low severity. CVSS v3 base score is 3.1 out of 10.