Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls. Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
{
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34769.json",
"cwe_ids": [
"CWE-88",
"CWE-912"
]
}{
"cpe": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "38.8.6"
},
{
"introduced": "39.0.0"
},
{
"fixed": "39.8.0"
},
{
"introduced": "40.0.0"
},
{
"fixed": "40.7.0"
}
],
"source": "CPE_RANGE"
}"2026-07-27T09:24:19Z"
[
{
"target": {
"file": "shell/browser/electron_permission_manager.h"
},
"id": "CVE-2026-34769-04c47c2f",
"digest": {
"line_hashes": [
"178675391894984138341889541690365973684",
"219130035380057126897531452099541104002",
"126028090964366337652820515559819811359"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/69c8cbf259da0f84e9c1db04958516a68f7170aa"
},
{
"target": {
"function": "WebContents::RequestKeyboardLock",
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2026-34769-16120300",
"digest": {
"function_hash": "97039591253026817807654837533762377827",
"length": 290.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/69c8cbf259da0f84e9c1db04958516a68f7170aa"
},
{
"target": {
"function": "Browser::SetAsDefaultProtocolClient",
"file": "shell/browser/browser_linux.cc"
},
"id": "CVE-2026-34769-2dde5c71",
"digest": {
"function_hash": "82341144211605073495315918430661873234",
"length": 115.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "UsbChooserController::OnDeviceAdded",
"file": "shell/browser/usb/usb_chooser_controller.cc"
},
"id": "CVE-2026-34769-2ece3857",
"digest": {
"function_hash": "61142233835202829958084947734626901732",
"length": 291.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/1598b9116daef641157c557153dc5d3b809fdf13"
},
{
"target": {
"function": "Browser::SetAsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34769-354827aa",
"digest": {
"function_hash": "175984606223393446076883997290339098880",
"length": 733.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "Browser::RemoveAsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34769-486406dc",
"digest": {
"function_hash": "68250451954765914529555384948311246821",
"length": 1186.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/api/electron_api_web_contents.h"
},
"id": "CVE-2026-34769-52d1698b",
"digest": {
"line_hashes": [
"302647440730222286742065939401885204342",
"213210996922622981944964345494938291300",
"46110625459178329298984308919692078035",
"308242114583160430057595766604657996435",
"15808636014665415213704106777963377880",
"23049463670308433760285037254266648460",
"169983092099714675976652469175961167629",
"220953584429958072043703509851474845330"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/69c8cbf259da0f84e9c1db04958516a68f7170aa"
},
{
"target": {
"function": "UsbChooserController::OnDeviceRemoved",
"file": "shell/browser/usb/usb_chooser_controller.cc"
},
"id": "CVE-2026-34769-7a17ee01",
"digest": {
"function_hash": "96155712548337292400733261458234038190",
"length": 265.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/1598b9116daef641157c557153dc5d3b809fdf13"
},
{
"target": {
"file": "shell/browser/usb/usb_chooser_controller.cc"
},
"id": "CVE-2026-34769-8cdb8f5e",
"digest": {
"line_hashes": [
"156275209481195871206198604452347446054",
"175877772127482286239303214206247257505",
"71474498449249973993196248779216514511",
"14940573484809719751531164629790354042",
"190626596885386175352053396729627138744",
"301807841628843703471653104348489734945",
"134462277057499600728895058009828883701",
"168811110514858893198152212864105933263",
"240796529130563652804681646259279239661",
"20980650432641246652071701519902713392",
"134163468621777755879592738116157554787",
"181675892745925892443378007541251482199",
"53631146889017094540018286417166122202",
"241994195701962275033055915236763659731",
"75252833910771996883857281786435442585",
"154658513830234467414558570821697542526",
"228916837748401816059853777773564214152"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/1598b9116daef641157c557153dc5d3b809fdf13"
},
{
"target": {
"function": "UsbChooserController::OnDeviceChosen",
"file": "shell/browser/usb/usb_chooser_controller.cc"
},
"id": "CVE-2026-34769-ad40a1da",
"digest": {
"function_hash": "297327772576386591164750756102735457707",
"length": 421.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/1598b9116daef641157c557153dc5d3b809fdf13"
},
{
"target": {
"function": "WebContents::~WebContents",
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2026-34769-b29fc49a",
"digest": {
"function_hash": "293482645540665903577029483346008950707",
"length": 694.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/69c8cbf259da0f84e9c1db04958516a68f7170aa"
},
{
"target": {
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34769-b4c40c8e",
"digest": {
"line_hashes": [
"184001071477640657346456013551722397714",
"285668318726846033667932124619028269519",
"314957172723790408012662599810195089716",
"4517750117920272910953900469464815953",
"321294864450645829895715185959011147038",
"177408552723683954668510149833806496102",
"60310313236459951343689554621996677488",
"310409286819299739101286034455357087335",
"188425286791056336369690276215264213619",
"266986245836037430376719900754930259625",
"60310313236459951343689554621996677488",
"310409286819299739101286034455357087335"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "WebContents::EnterFullscreenModeForTab",
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2026-34769-b73afd14",
"digest": {
"function_hash": "200189763688856902106236158256740166562",
"length": 417.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/69c8cbf259da0f84e9c1db04958516a68f7170aa"
},
{
"target": {
"function": "WebContents::RequestPointerLock",
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2026-34769-bebe9c57",
"digest": {
"function_hash": "142894579126557078612750465996125695405",
"length": 309.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/69c8cbf259da0f84e9c1db04958516a68f7170aa"
},
{
"target": {
"file": "shell/browser/browser.h"
},
"id": "CVE-2026-34769-bf97cb8f",
"digest": {
"line_hashes": [
"260432305565188720774320473196314341923",
"334270560813533467464039160557033392559",
"35192039691071152136950982098365127489"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2026-34769-c094721e",
"digest": {
"line_hashes": [
"172254940840651545307547467675269355390",
"203776172793253186837188577032711806018",
"292057948711896347295010900533229588006",
"86626044662892447202740804354061256814",
"302047480695382285029110301698887214484",
"200523701153566048891738146168306534323",
"224695972079447967607053995532785191113",
"5516346858382603644295849184690449718",
"272975537203403675984099548741835201505",
"323679966937264236305706957393290082246",
"167740096839072816910168742268814651714",
"187115845473996675337174991740048671859",
"19226079768645679789525655827032305715",
"291620580006522488323469082307520992334",
"321205863328364055224016726868757299699",
"150332271850213351345388275646695595103",
"225886463583132774994553655690143237585",
"88922925232342227464352931942020322447",
"204166832810991155569094000977144475182",
"10127105033526569746140614845050393412",
"136357128351224668959564582626865229772",
"159122646162125252544582092365633912365",
"197974183905236273378319630751641312316",
"275365673647440653900725970873246504437",
"257584571322843584030141831554521920399",
"257160280229469026798715795645251610844",
"46773167401156905844124568335873804315",
"294806251294630468732661873797615442847",
"163064322362209515105295693592644273463",
"139352105874698319173624790048228061604",
"14291476199439583193750193055633443327"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/69c8cbf259da0f84e9c1db04958516a68f7170aa"
},
{
"target": {
"file": "shell/browser/usb/usb_chooser_controller.h"
},
"id": "CVE-2026-34769-c3930a42",
"digest": {
"line_hashes": [
"293520790029042136735839112743715105738",
"99519798731736299611781643717627917549",
"278020203046355500786065357035235163632",
"330363439832660583890684009329944399467"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/1598b9116daef641157c557153dc5d3b809fdf13"
},
{
"target": {
"file": "shell/browser/browser_linux.cc"
},
"id": "CVE-2026-34769-d23d34c9",
"digest": {
"line_hashes": [
"168477483023980236894774079564256179740",
"120591530035547590376345695593028510910",
"287703235042020718697344900005833442140",
"79524099051086166592493852609095961088",
"39538603236634876488930068352779111002",
"286126886422000462295626452239097757401",
"209858025069869986480066377373189965926",
"138185895275594626417956315158450728222",
"285609270383540029742982815560702152217",
"17297005053126020885978291009464847621",
"263439810505672934553031241598385686748"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/browser.cc"
},
"id": "CVE-2026-34769-da0afa31",
"digest": {
"line_hashes": [
"57091761162372167441997243932069369719",
"139467101515551557893745183973111771089",
"148288767550464201986939322682459884147",
"268461582712617073537525257834049657858",
"106184347562513450236971598357404008264",
"276196451503965926378153345272103361953",
"209352198640994034316976330131828904214",
"95787503736654878625834293153430670949"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "WebContents::OnEnterFullscreenModeForTab",
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"id": "CVE-2026-34769-e7b4e66d",
"digest": {
"function_hash": "251157994721493377634460688639175075370",
"length": 695.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/69c8cbf259da0f84e9c1db04958516a68f7170aa"
},
{
"target": {
"file": "shell/browser/electron_permission_manager.cc"
},
"id": "CVE-2026-34769-f9bf6085",
"digest": {
"line_hashes": [
"163598223645556799758809004922253860728",
"328782403901881463597991084953359396933",
"145653381957897113583178423854806299436"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/69c8cbf259da0f84e9c1db04958516a68f7170aa"
},
{
"target": {
"function": "Browser::IsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34769-fbfaedd4",
"digest": {
"function_hash": "42732246160536796049773581149226801294",
"length": 643.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "Browser::IsDefaultProtocolClient",
"file": "shell/browser/browser_linux.cc"
},
"id": "CVE-2026-34769-ffea4a6c",
"digest": {
"function_hash": "45250681603630778623217806006703361834",
"length": 573.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34769.json"