Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-125"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114124.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "42.11.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "43.0.0-alpha.1"
},
{
"fixed": "43.7.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "44.0.0-alpha.1"
},
{
"fixed": "44.4.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "45.0.0-alpha.1"
},
{
"fixed": "45.0.0-alpha.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "24d8dbc661c6a109476ae59e9a2740b35d005cf4"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "64ae597deda8956037387b439e6361f0fe936c86"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "8d48be150c3fd53b0d02854124bdb7858598799c"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d496507ffa1693edaa704a4be130fbcb8ecb4ada"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "d7f87070a8d738e561245d1ade4d6fbb082db80a"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "v42.11.6",
"range": [
{
"fixed": "4c6c28d5e0c4f60a80e4076b8c75767b1c3c4119"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v43.7.3",
"range": [
{
"fixed": "79de330422c91960492053e3e7d894911eddb55a"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v44.4.3",
"range": [
{
"fixed": "14420471921fcc4546eb875955806aa44f15be92"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v45.0.0-alpha.9",
"range": [
{
"fixed": "3197bf24283a107fa183614d83bedf1db0186ee4"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114124.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"145923310367869705812123378741190375902",
"107460506837170762672104578037787752908",
"63536845395256064844044733993333191876",
"177141907012220131423634093670406036527",
"179404927408516969103186083575673474041",
"137050094762770498759991099607930191498",
"20143624026582489141761740731494801947",
"188435075351876123694066394013477360353",
"56774103734719937386381210706795076389",
"197390937822244451630759256400395708376",
"159053586338841126833715710277835328760",
"170133094357086791691081058479648480860",
"10317269603209100059262204786470312472",
"232843557910206273545414963633259929001",
"203032254595066202520228271085901875923",
"269437019204568539592945846005212216939",
"98744557272430749092213815724897528297",
"80775837756613340121391860941471740864",
"142720861266119996478617612793904141250"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-1824c54b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c",
"target": {
"file": "shell/browser/api/frame_subscriber.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"58468132597336953844299311490736496409",
"282005347290221780208772994072827860190",
"89547444874992647692021173701835425137",
"69327500327349560577174242460637878335",
"285072898786031557735924866353452371918",
"236266619985108283049145620685413508298",
"134403736053417284262928442654846623404",
"4856769121467930133634392364833585281",
"237948538645386360252763399301641802847",
"261725391555149618470247729084717875065",
"14739311722522588594554643614479519695",
"124581624131357821734101388286560425146",
"259375627484297340220530024726768137585",
"207610762060044536792383481043014450444",
"271826691441105571158197673409687031753",
"117696702355014033895434859211322320814"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-4a506a0c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86",
"target": {
"file": "shell/browser/osr/osr_video_consumer.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"58468132597336953844299311490736496409",
"282005347290221780208772994072827860190",
"89547444874992647692021173701835425137",
"69327500327349560577174242460637878335",
"285072898786031557735924866353452371918",
"236266619985108283049145620685413508298",
"134403736053417284262928442654846623404",
"4856769121467930133634392364833585281",
"237948538645386360252763399301641802847",
"261725391555149618470247729084717875065",
"14739311722522588594554643614479519695",
"124581624131357821734101388286560425146",
"259375627484297340220530024726768137585",
"207610762060044536792383481043014450444",
"271826691441105571158197673409687031753",
"117696702355014033895434859211322320814"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-69fd560a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/8d48be150c3fd53b0d02854124bdb7858598799c",
"target": {
"file": "shell/browser/osr/osr_video_consumer.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"145923310367869705812123378741190375902",
"107460506837170762672104578037787752908",
"63536845395256064844044733993333191876",
"177141907012220131423634093670406036527",
"179404927408516969103186083575673474041",
"137050094762770498759991099607930191498",
"20143624026582489141761740731494801947",
"188435075351876123694066394013477360353",
"56774103734719937386381210706795076389",
"197390937822244451630759256400395708376",
"159053586338841126833715710277835328760",
"170133094357086791691081058479648480860",
"10317269603209100059262204786470312472",
"232843557910206273545414963633259929001",
"203032254595066202520228271085901875923",
"269437019204568539592945846005212216939",
"98744557272430749092213815724897528297",
"80775837756613340121391860941471740864",
"142720861266119996478617612793904141250"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-87f2cec6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4",
"target": {
"file": "shell/browser/api/frame_subscriber.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"145923310367869705812123378741190375902",
"107460506837170762672104578037787752908",
"63536845395256064844044733993333191876",
"177141907012220131423634093670406036527",
"179404927408516969103186083575673474041",
"137050094762770498759991099607930191498",
"20143624026582489141761740731494801947",
"188435075351876123694066394013477360353",
"56774103734719937386381210706795076389",
"197390937822244451630759256400395708376",
"159053586338841126833715710277835328760",
"170133094357086791691081058479648480860",
"10317269603209100059262204786470312472",
"232843557910206273545414963633259929001",
"203032254595066202520228271085901875923",
"269437019204568539592945846005212216939",
"98744557272430749092213815724897528297",
"80775837756613340121391860941471740864",
"142720861266119996478617612793904141250"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-b17c63a2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada",
"target": {
"file": "shell/browser/api/frame_subscriber.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"141252922613893187070884474949676654296",
"104156309948242518719885972458351459828",
"899300151377187438976270498060687713",
"69327500327349560577174242460637878335",
"285072898786031557735924866353452371918",
"236266619985108283049145620685413508298",
"134403736053417284262928442654846623404",
"4856769121467930133634392364833585281",
"237948538645386360252763399301641802847",
"261725391555149618470247729084717875065",
"14739311722522588594554643614479519695",
"124581624131357821734101388286560425146",
"259375627484297340220530024726768137585",
"207610762060044536792383481043014450444",
"271826691441105571158197673409687031753",
"117696702355014033895434859211322320814"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-b441d34c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a",
"target": {
"file": "shell/browser/osr/osr_video_consumer.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"145923310367869705812123378741190375902",
"107460506837170762672104578037787752908",
"63536845395256064844044733993333191876",
"177141907012220131423634093670406036527",
"179404927408516969103186083575673474041",
"137050094762770498759991099607930191498",
"20143624026582489141761740731494801947",
"188435075351876123694066394013477360353",
"56774103734719937386381210706795076389",
"197390937822244451630759256400395708376",
"159053586338841126833715710277835328760",
"170133094357086791691081058479648480860",
"10317269603209100059262204786470312472",
"232843557910206273545414963633259929001",
"203032254595066202520228271085901875923",
"269437019204568539592945846005212216939",
"98744557272430749092213815724897528297",
"80775837756613340121391860941471740864",
"142720861266119996478617612793904141250"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-bbfdd478",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/64ae597deda8956037387b439e6361f0fe936c86",
"target": {
"file": "shell/browser/api/frame_subscriber.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"145923310367869705812123378741190375902",
"107460506837170762672104578037787752908",
"63536845395256064844044733993333191876",
"177141907012220131423634093670406036527",
"179404927408516969103186083575673474041",
"137050094762770498759991099607930191498",
"20143624026582489141761740731494801947",
"188435075351876123694066394013477360353",
"56774103734719937386381210706795076389",
"197390937822244451630759256400395708376",
"159053586338841126833715710277835328760",
"170133094357086791691081058479648480860",
"10317269603209100059262204786470312472",
"232843557910206273545414963633259929001",
"203032254595066202520228271085901875923",
"269437019204568539592945846005212216939",
"98744557272430749092213815724897528297",
"80775837756613340121391860941471740864",
"142720861266119996478617612793904141250"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-cc974c9f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/d7f87070a8d738e561245d1ade4d6fbb082db80a",
"target": {
"file": "shell/browser/api/frame_subscriber.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"141252922613893187070884474949676654296",
"104156309948242518719885972458351459828",
"899300151377187438976270498060687713",
"69327500327349560577174242460637878335",
"285072898786031557735924866353452371918",
"236266619985108283049145620685413508298",
"134403736053417284262928442654846623404",
"4856769121467930133634392364833585281",
"237948538645386360252763399301641802847",
"261725391555149618470247729084717875065",
"14739311722522588594554643614479519695",
"124581624131357821734101388286560425146",
"259375627484297340220530024726768137585",
"207610762060044536792383481043014450444",
"271826691441105571158197673409687031753",
"117696702355014033895434859211322320814"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-d43b3066",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/d496507ffa1693edaa704a4be130fbcb8ecb4ada",
"target": {
"file": "shell/browser/osr/osr_video_consumer.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"58468132597336953844299311490736496409",
"282005347290221780208772994072827860190",
"89547444874992647692021173701835425137",
"69327500327349560577174242460637878335",
"285072898786031557735924866353452371918",
"236266619985108283049145620685413508298",
"134403736053417284262928442654846623404",
"4856769121467930133634392364833585281",
"237948538645386360252763399301641802847",
"261725391555149618470247729084717875065",
"14739311722522588594554643614479519695",
"124581624131357821734101388286560425146",
"259375627484297340220530024726768137585",
"207610762060044536792383481043014450444",
"271826691441105571158197673409687031753",
"117696702355014033895434859211322320814"
],
"threshold": 0.9
},
"id": "CVE-2026-114124-ec4a7064",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/24d8dbc661c6a109476ae59e9a2740b35d005cf4",
"target": {
"file": "shell/browser/osr/osr_video_consumer.cc"
}
}
]
"2026-10-22T07:41:27Z"