Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3, apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled input is reflected into a response header name or value. An attacker who can influence a header value may be able to inject additional response headers, affecting cookies, content security policy, or cross-origin access controls. Apps that do not reflect external input into response headers are not affected. This issue has been patched in versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3.
{
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34767.json",
"cwe_ids": [
"CWE-113",
"CWE-74"
]
}{
"cpe": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "38.8.6"
},
{
"introduced": "39.0.0"
},
{
"fixed": "39.8.3"
},
{
"introduced": "40.0.0"
},
{
"fixed": "40.8.3"
},
{
"introduced": "41.0.0"
},
{
"fixed": "41.0.3"
}
],
"source": "CPE_RANGE"
}"2026-07-27T09:24:18Z"
[
{
"target": {
"file": "shell/browser/native_window_views.cc"
},
"id": "CVE-2026-34767-1cf666b6",
"digest": {
"line_hashes": [
"205415534522017239659510457530373816720",
"130685224942462917488835812507970657825",
"124772532014323817400024109509587539677",
"337470349513803097349710320708877690450",
"320353361375553412542783699785379807378",
"141824746376442360601204037795491350479",
"320151939098215504041218884866795843906",
"291847833596063846832476711117784337257",
"103012103049941839143103943663748140301",
"290659156243401048752054662682351816640",
"195957417606930301148699116628942788731",
"258404496157234644084615552988947563884",
"259436527498107594941943577431164650674"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/e6928c13198c854aa014c319d72eea599e2e0ee7"
},
{
"target": {
"function": "NativeWindowViews::CanResize",
"file": "shell/browser/native_window_views.cc"
},
"id": "CVE-2026-34767-28d2d4f3",
"digest": {
"function_hash": "47044044847902906986049886644313308739",
"length": 144.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/44bc2c8cef90c347c07060d6c9080bbe0f351dfb"
},
{
"target": {
"function": "Browser::SetAsDefaultProtocolClient",
"file": "shell/browser/browser_linux.cc"
},
"id": "CVE-2026-34767-2dde5c71",
"digest": {
"function_hash": "82341144211605073495315918430661873234",
"length": 115.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "Browser::SetAsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34767-354827aa",
"digest": {
"function_hash": "175984606223393446076883997290339098880",
"length": 733.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/native_window_views.cc"
},
"id": "CVE-2026-34767-3cb9403a",
"digest": {
"line_hashes": [
"205415534522017239659510457530373816720",
"130685224942462917488835812507970657825",
"124772532014323817400024109509587539677",
"337470349513803097349710320708877690450",
"320353361375553412542783699785379807378",
"141824746376442360601204037795491350479",
"320151939098215504041218884866795843906",
"291847833596063846832476711117784337257",
"103012103049941839143103943663748140301",
"290659156243401048752054662682351816640",
"195957417606930301148699116628942788731",
"258404496157234644084615552988947563884",
"259436527498107594941943577431164650674"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/44bc2c8cef90c347c07060d6c9080bbe0f351dfb"
},
{
"target": {
"function": "Browser::RemoveAsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34767-486406dc",
"digest": {
"function_hash": "68250451954765914529555384948311246821",
"length": 1186.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/native_window_views.cc"
},
"id": "CVE-2026-34767-63d04847",
"digest": {
"line_hashes": [
"205415534522017239659510457530373816720",
"130685224942462917488835812507970657825",
"124772532014323817400024109509587539677",
"337470349513803097349710320708877690450",
"320353361375553412542783699785379807378",
"141824746376442360601204037795491350479",
"320151939098215504041218884866795843906",
"291847833596063846832476711117784337257",
"103012103049941839143103943663748140301",
"290659156243401048752054662682351816640",
"195957417606930301148699116628942788731",
"258404496157234644084615552988947563884",
"259436527498107594941943577431164650674"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/e094b3939edf4135d3907968f7ec5179f5f46b93"
},
{
"target": {
"function": "NativeWindowViews::CanResize",
"file": "shell/browser/native_window_views.cc"
},
"id": "CVE-2026-34767-6a9baeb7",
"digest": {
"function_hash": "47044044847902906986049886644313308739",
"length": 144.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/e6928c13198c854aa014c319d72eea599e2e0ee7"
},
{
"target": {
"function": "NativeWindowViews::CanResize",
"file": "shell/browser/native_window_views.cc"
},
"id": "CVE-2026-34767-992f97ad",
"digest": {
"function_hash": "47044044847902906986049886644313308739",
"length": 144.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/e094b3939edf4135d3907968f7ec5179f5f46b93"
},
{
"target": {
"function": "NativeWindowViews::IsResizable",
"file": "shell/browser/native_window_views.cc"
},
"id": "CVE-2026-34767-a40e50f6",
"digest": {
"function_hash": "207743162330393379160275817361382389043",
"length": 191.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/e094b3939edf4135d3907968f7ec5179f5f46b93"
},
{
"target": {
"function": "NativeWindowViews::IsResizable",
"file": "shell/browser/native_window_views.cc"
},
"id": "CVE-2026-34767-aa7fbe9b",
"digest": {
"function_hash": "207743162330393379160275817361382389043",
"length": 191.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/44bc2c8cef90c347c07060d6c9080bbe0f351dfb"
},
{
"target": {
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34767-b4c40c8e",
"digest": {
"line_hashes": [
"184001071477640657346456013551722397714",
"285668318726846033667932124619028269519",
"314957172723790408012662599810195089716",
"4517750117920272910953900469464815953",
"321294864450645829895715185959011147038",
"177408552723683954668510149833806496102",
"60310313236459951343689554621996677488",
"310409286819299739101286034455357087335",
"188425286791056336369690276215264213619",
"266986245836037430376719900754930259625",
"60310313236459951343689554621996677488",
"310409286819299739101286034455357087335"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/browser.h"
},
"id": "CVE-2026-34767-bf97cb8f",
"digest": {
"line_hashes": [
"260432305565188720774320473196314341923",
"334270560813533467464039160557033392559",
"35192039691071152136950982098365127489"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "NativeWindowViews::IsResizable",
"file": "shell/browser/native_window_views.cc"
},
"id": "CVE-2026-34767-ce0b809e",
"digest": {
"function_hash": "207743162330393379160275817361382389043",
"length": 191.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/e6928c13198c854aa014c319d72eea599e2e0ee7"
},
{
"target": {
"file": "shell/browser/browser_linux.cc"
},
"id": "CVE-2026-34767-d23d34c9",
"digest": {
"line_hashes": [
"168477483023980236894774079564256179740",
"120591530035547590376345695593028510910",
"287703235042020718697344900005833442140",
"79524099051086166592493852609095961088",
"39538603236634876488930068352779111002",
"286126886422000462295626452239097757401",
"209858025069869986480066377373189965926",
"138185895275594626417956315158450728222",
"285609270383540029742982815560702152217",
"17297005053126020885978291009464847621",
"263439810505672934553031241598385686748"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/browser.cc"
},
"id": "CVE-2026-34767-da0afa31",
"digest": {
"line_hashes": [
"57091761162372167441997243932069369719",
"139467101515551557893745183973111771089",
"148288767550464201986939322682459884147",
"268461582712617073537525257834049657858",
"106184347562513450236971598357404008264",
"276196451503965926378153345272103361953",
"209352198640994034316976330131828904214",
"95787503736654878625834293153430670949"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "Browser::IsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34767-fbfaedd4",
"digest": {
"function_hash": "42732246160536796049773581149226801294",
"length": 643.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "Browser::IsDefaultProtocolClient",
"file": "shell/browser/browser_linux.cc"
},
"id": "CVE-2026-34767-ffea4a6c",
"digest": {
"function_hash": "45250681603630778623217806006703361834",
"length": 573.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34767.json"