Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-862"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113797.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "42.11.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "43.0.0-alpha.1"
},
{
"fixed": "43.5.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "44.0.0-alpha.1"
},
{
"fixed": "44.1.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "45.0.0-alpha.1"
},
{
"fixed": "45.0.0-alpha.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "16e6103c1d84cd1c46336647b55e96414da501a4"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "5acc76667d32ff310d04f965b47983412ab6553c"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d6529d65e5f096cd45bbb2828febb2c6baa53921"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "v42.11.1",
"range": [
{
"fixed": "b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v43.5.1",
"range": [
{
"fixed": "8e510230cbd48672c46dca36616b3dbde99fa379"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v44.1.1",
"range": [
{
"fixed": "f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v45.0.0-alpha.4",
"range": [
{
"fixed": "483719ce28fa8faf60d550f58f0c4f61af688373"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113797.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "189801906466566197476259109612362494884",
"length": 2341
},
"id": "CVE-2026-113797-0bf86845",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsQueryFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "189801906466566197476259109612362494884",
"length": 2341
},
"id": "CVE-2026-113797-0e61f151",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsQueryFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314815346166711223064109598539250151580",
"length": 940
},
"id": "CVE-2026-113797-1b43cd1f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsGetFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "44222992853855679903761441460371535629",
"length": 835
},
"id": "CVE-2026-113797-42461e6e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsUpdateFunction::GetResult"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "44222992853855679903761441460371535629",
"length": 835
},
"id": "CVE-2026-113797-5866837d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsUpdateFunction::GetResult"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314815346166711223064109598539250151580",
"length": 940
},
"id": "CVE-2026-113797-59d96a00",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsGetFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302672899478307841823007165015792623629",
"164825100260586282034724157250112164082",
"169091340896178525513314179251614813103",
"572415122366035991520426512924873861",
"172136490723351766567543235884918265850",
"68471599212842146731867372677020326233",
"211747360540938571227173202069846529486",
"78453088751123681317786970556573638719",
"256983931036190286991118384074908397191",
"3722743086884457701412397917652110430",
"14755775171440176488194849584033781069",
"105293830200659539176913765171684888245",
"110378722205131147294734886979368198856",
"313296912296863900419551397614318890474",
"30100809230315696665266261793978065254",
"48131067444910989687502660813824582913",
"450046817650370306584042751514783948",
"2452024804002174858037171302649518616",
"274777932411197428401266657341099347107",
"14239406045206837187219152793431755067",
"249863664365152912337970473003185903446",
"96437481036452112848796167185416102434",
"89506893178788095731583972261755919653",
"164773258895014831812557676045850935962",
"309020180054904165187139110580132814158",
"242398234700814637555075543555041499682",
"293921953463469620039982988787360249188",
"72910750278138378467696428022882379352",
"202446865809137404534142827011878208240",
"21618615547759058684666930571049804869",
"75201338367883292854104768120365740078",
"247111475307178418612981370304510121571",
"42809886810949300355380576967278042426",
"284067008032358056757861833010757650719",
"184522087572074588608553385385669123421",
"227086275579420134965012348733724957888"
],
"threshold": 0.9
},
"id": "CVE-2026-113797-67378e0e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314815346166711223064109598539250151580",
"length": 940
},
"id": "CVE-2026-113797-6a283dd4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsGetFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "189801906466566197476259109612362494884",
"length": 2341
},
"id": "CVE-2026-113797-6f7fdd6a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsQueryFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "189801906466566197476259109612362494884",
"length": 2341
},
"id": "CVE-2026-113797-85d585c8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsQueryFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302672899478307841823007165015792623629",
"164825100260586282034724157250112164082",
"169091340896178525513314179251614813103",
"572415122366035991520426512924873861",
"172136490723351766567543235884918265850",
"68471599212842146731867372677020326233",
"211747360540938571227173202069846529486",
"78453088751123681317786970556573638719",
"256983931036190286991118384074908397191",
"3722743086884457701412397917652110430",
"14755775171440176488194849584033781069",
"105293830200659539176913765171684888245",
"110378722205131147294734886979368198856",
"313296912296863900419551397614318890474",
"30100809230315696665266261793978065254",
"48131067444910989687502660813824582913",
"450046817650370306584042751514783948",
"2452024804002174858037171302649518616",
"274777932411197428401266657341099347107",
"14239406045206837187219152793431755067",
"249863664365152912337970473003185903446",
"96437481036452112848796167185416102434",
"89506893178788095731583972261755919653",
"164773258895014831812557676045850935962",
"309020180054904165187139110580132814158",
"242398234700814637555075543555041499682",
"293921953463469620039982988787360249188",
"72910750278138378467696428022882379352",
"202446865809137404534142827011878208240",
"21618615547759058684666930571049804869",
"75201338367883292854104768120365740078",
"247111475307178418612981370304510121571",
"42809886810949300355380576967278042426",
"284067008032358056757861833010757650719",
"184522087572074588608553385385669123421",
"227086275579420134965012348733724957888"
],
"threshold": 0.9
},
"id": "CVE-2026-113797-89716cf2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314815346166711223064109598539250151580",
"length": 940
},
"id": "CVE-2026-113797-9a08388c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsGetFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "44222992853855679903761441460371535629",
"length": 835
},
"id": "CVE-2026-113797-a4e4e775",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsUpdateFunction::GetResult"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "44222992853855679903761441460371535629",
"length": 835
},
"id": "CVE-2026-113797-bb901763",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsUpdateFunction::GetResult"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "314815346166711223064109598539250151580",
"length": 940
},
"id": "CVE-2026-113797-c1e9704f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsGetFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302672899478307841823007165015792623629",
"164825100260586282034724157250112164082",
"169091340896178525513314179251614813103",
"572415122366035991520426512924873861",
"172136490723351766567543235884918265850",
"68471599212842146731867372677020326233",
"211747360540938571227173202069846529486",
"78453088751123681317786970556573638719",
"256983931036190286991118384074908397191",
"3722743086884457701412397917652110430",
"14755775171440176488194849584033781069",
"105293830200659539176913765171684888245",
"110378722205131147294734886979368198856",
"313296912296863900419551397614318890474",
"30100809230315696665266261793978065254",
"48131067444910989687502660813824582913",
"450046817650370306584042751514783948",
"2452024804002174858037171302649518616",
"274777932411197428401266657341099347107",
"14239406045206837187219152793431755067",
"249863664365152912337970473003185903446",
"96437481036452112848796167185416102434",
"89506893178788095731583972261755919653",
"164773258895014831812557676045850935962",
"309020180054904165187139110580132814158",
"242398234700814637555075543555041499682",
"293921953463469620039982988787360249188",
"72910750278138378467696428022882379352",
"202446865809137404534142827011878208240",
"21618615547759058684666930571049804869",
"75201338367883292854104768120365740078",
"247111475307178418612981370304510121571",
"42809886810949300355380576967278042426",
"284067008032358056757861833010757650719",
"184522087572074588608553385385669123421",
"227086275579420134965012348733724957888"
],
"threshold": 0.9
},
"id": "CVE-2026-113797-c31c443e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "44222992853855679903761441460371535629",
"length": 835
},
"id": "CVE-2026-113797-cecee45e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsUpdateFunction::GetResult"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "189801906466566197476259109612362494884",
"length": 2341
},
"id": "CVE-2026-113797-ed1fab41",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc",
"function": "TabsQueryFunction::Run"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302672899478307841823007165015792623629",
"164825100260586282034724157250112164082",
"169091340896178525513314179251614813103",
"572415122366035991520426512924873861",
"172136490723351766567543235884918265850",
"68471599212842146731867372677020326233",
"211747360540938571227173202069846529486",
"78453088751123681317786970556573638719",
"256983931036190286991118384074908397191",
"3722743086884457701412397917652110430",
"14755775171440176488194849584033781069",
"105293830200659539176913765171684888245",
"110378722205131147294734886979368198856",
"313296912296863900419551397614318890474",
"30100809230315696665266261793978065254",
"48131067444910989687502660813824582913",
"450046817650370306584042751514783948",
"2452024804002174858037171302649518616",
"274777932411197428401266657341099347107",
"14239406045206837187219152793431755067",
"249863664365152912337970473003185903446",
"96437481036452112848796167185416102434",
"89506893178788095731583972261755919653",
"164773258895014831812557676045850935962",
"309020180054904165187139110580132814158",
"242398234700814637555075543555041499682",
"293921953463469620039982988787360249188",
"72910750278138378467696428022882379352",
"202446865809137404534142827011878208240",
"21618615547759058684666930571049804869",
"75201338367883292854104768120365740078",
"247111475307178418612981370304510121571",
"42809886810949300355380576967278042426",
"284067008032358056757861833010757650719",
"184522087572074588608553385385669123421",
"227086275579420134965012348733724957888"
],
"threshold": 0.9
},
"id": "CVE-2026-113797-f5527a55",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302672899478307841823007165015792623629",
"164825100260586282034724157250112164082",
"169091340896178525513314179251614813103",
"572415122366035991520426512924873861",
"172136490723351766567543235884918265850",
"68471599212842146731867372677020326233",
"211747360540938571227173202069846529486",
"78453088751123681317786970556573638719",
"256983931036190286991118384074908397191",
"3722743086884457701412397917652110430",
"14755775171440176488194849584033781069",
"105293830200659539176913765171684888245",
"110378722205131147294734886979368198856",
"313296912296863900419551397614318890474",
"30100809230315696665266261793978065254",
"48131067444910989687502660813824582913",
"450046817650370306584042751514783948",
"2452024804002174858037171302649518616",
"274777932411197428401266657341099347107",
"14239406045206837187219152793431755067",
"249863664365152912337970473003185903446",
"96437481036452112848796167185416102434",
"89506893178788095731583972261755919653",
"164773258895014831812557676045850935962",
"309020180054904165187139110580132814158",
"242398234700814637555075543555041499682",
"293921953463469620039982988787360249188",
"72910750278138378467696428022882379352",
"202446865809137404534142827011878208240",
"21618615547759058684666930571049804869",
"75201338367883292854104768120365740078",
"247111475307178418612981370304510121571",
"42809886810949300355380576967278042426",
"284067008032358056757861833010757650719",
"184522087572074588608553385385669123421",
"227086275579420134965012348733724957888"
],
"threshold": 0.9
},
"id": "CVE-2026-113797-f76fa441",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921",
"target": {
"file": "shell/browser/extensions/api/tabs/tabs_api.cc"
}
}
]
"2026-10-22T07:41:24Z"