Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.
{
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34775.json",
"cwe_ids": [
"CWE-653"
]
}{
"cpe": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "38.8.6"
},
{
"introduced": "39.0.0"
},
{
"fixed": "39.8.4"
},
{
"introduced": "40.0.0"
},
{
"fixed": "40.8.4"
}
],
"source": "CPE_RANGE"
}"2026-07-27T09:24:27Z"
[
{
"target": {
"function": "WebContentsPreferences::AppendCommandLineSwitches",
"file": "shell/browser/web_contents_preferences.cc"
},
"id": "CVE-2026-34775-26a53a29",
"digest": {
"function_hash": "263178020689083171901394488649564831306",
"length": 1112.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/2871c1d392ad1e162a1410a4f42981e253aab122"
},
{
"target": {
"function": "Browser::SetAsDefaultProtocolClient",
"file": "shell/browser/browser_linux.cc"
},
"id": "CVE-2026-34775-2dde5c71",
"digest": {
"function_hash": "82341144211605073495315918430661873234",
"length": 115.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "Browser::SetAsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34775-354827aa",
"digest": {
"function_hash": "175984606223393446076883997290339098880",
"length": 733.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "Browser::RemoveAsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34775-486406dc",
"digest": {
"function_hash": "68250451954765914529555384948311246821",
"length": 1186.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/common/options_switches.h"
},
"id": "CVE-2026-34775-54aa7f7a",
"digest": {
"line_hashes": [
"170970637432285702256320227727796962977",
"35642526911221958939918458312548311562",
"198114220526991846822839255622316723951",
"37154315874050688560321550123755796365",
"47849235095246119041072986788051902121"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/2871c1d392ad1e162a1410a4f42981e253aab122"
},
{
"target": {
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34775-b4c40c8e",
"digest": {
"line_hashes": [
"184001071477640657346456013551722397714",
"285668318726846033667932124619028269519",
"314957172723790408012662599810195089716",
"4517750117920272910953900469464815953",
"321294864450645829895715185959011147038",
"177408552723683954668510149833806496102",
"60310313236459951343689554621996677488",
"310409286819299739101286034455357087335",
"188425286791056336369690276215264213619",
"266986245836037430376719900754930259625",
"60310313236459951343689554621996677488",
"310409286819299739101286034455357087335"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/browser.h"
},
"id": "CVE-2026-34775-bf97cb8f",
"digest": {
"line_hashes": [
"260432305565188720774320473196314341923",
"334270560813533467464039160557033392559",
"35192039691071152136950982098365127489"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/web_contents_preferences.cc"
},
"id": "CVE-2026-34775-d0e51287",
"digest": {
"line_hashes": [
"22307690537871346570255460851344072828",
"160987529803637450136259465356005494687",
"18984858430734182860548697792010320058",
"34309928673047502375935673444266395206",
"126174502102787184888439444629969015999"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/2871c1d392ad1e162a1410a4f42981e253aab122"
},
{
"target": {
"file": "shell/browser/browser_linux.cc"
},
"id": "CVE-2026-34775-d23d34c9",
"digest": {
"line_hashes": [
"168477483023980236894774079564256179740",
"120591530035547590376345695593028510910",
"287703235042020718697344900005833442140",
"79524099051086166592493852609095961088",
"39538603236634876488930068352779111002",
"286126886422000462295626452239097757401",
"209858025069869986480066377373189965926",
"138185895275594626417956315158450728222",
"285609270383540029742982815560702152217",
"17297005053126020885978291009464847621",
"263439810505672934553031241598385686748"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/browser/browser.cc"
},
"id": "CVE-2026-34775-da0afa31",
"digest": {
"line_hashes": [
"57091761162372167441997243932069369719",
"139467101515551557893745183973111771089",
"148288767550464201986939322682459884147",
"268461582712617073537525257834049657858",
"106184347562513450236971598357404008264",
"276196451503965926378153345272103361953",
"209352198640994034316976330131828904214",
"95787503736654878625834293153430670949"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"file": "shell/renderer/electron_renderer_client.cc"
},
"id": "CVE-2026-34775-de63b412",
"digest": {
"line_hashes": [
"171476209745931196858357282083601451145",
"266520143789839223313563099150387662295",
"303251481713241286219127695035865951895",
"13738064262932797497695478019048200435",
"153042977818970640571575130094811736831",
"220339182963250951115996874288966467365",
"3014724314050508489801763391746589168",
"233701212515140280086849394744139798217",
"115927323430743552176263463598187122762",
"53628415384047713398303261336807743699",
"150015448262200862873972876502933497106",
"314343417163160801697104306095227589995",
"11714401990557279307013153167660663903",
"105515676305961880608375057223881687077",
"208048581404641224747665415250175096486",
"85928209863022740660147524133769158278",
"295672344141798813475706632702103322597",
"65852320809435784130483115579427059359",
"94707496178123201779586924382133930500",
"161139293111368873884650433354026058156",
"83472740218079086180510666962973718680",
"191698514794201056313005213581717348950",
"292212358707060857842437311091667790521",
"89695960559823165946670720503118393545",
"218691373568981864093132603871806659585",
"165214999995870417966955921169452982656",
"11714401990557279307013153167660663903",
"105515676305961880608375057223881687077",
"208048581404641224747665415250175096486",
"85928209863022740660147524133769158278",
"295672344141798813475706632702103322597",
"65852320809435784130483115579427059359",
"77320934960179324757747472376809060782",
"283766107941591066334887494417995002881",
"323407891721245597451786590582557822806",
"173354310117625844780422229398911904466",
"91811231330727060069103328796585284238"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/2871c1d392ad1e162a1410a4f42981e253aab122"
},
{
"target": {
"function": "Browser::IsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
},
"id": "CVE-2026-34775-fbfaedd4",
"digest": {
"function_hash": "42732246160536796049773581149226801294",
"length": 643.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
},
{
"target": {
"function": "Browser::IsDefaultProtocolClient",
"file": "shell/browser/browser_linux.cc"
},
"id": "CVE-2026-34775-ffea4a6c",
"digest": {
"function_hash": "45250681603630778623217806006703361834",
"length": 573.0
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34775.json"