What is CVE-2026-34775?

CVE-2026-34775 is a medium-severity vulnerability in Electron, classified under CWE-653. CVSS score: 6.8/10. Published 2026-04-04.

How severe is CVE-2026-34775?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Electron

CVE-2026-34775

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.

EPSS: 0.003 (21.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.

Affected products

Electron — versions < 38.8.6, >= 39.0.0-alpha.1, < 39.8.4, >= 40.0.0-alpha.1, < 40.8.4
Electronjs Electron — versions 41.0.0

Weakness classification (CWE)

CWE-653

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-34775?: CVE-2026-34775 is a medium-severity vulnerability in Electron, classified under CWE-653. CVSS score: 6.8/10. Published 2026-04-04.
How severe is CVE-2026-34775?: Medium severity. CVSS v3 base score is 6.8 out of 10.