Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the move-to-Applications prompt. Apps are only affected if they call app.moveToApplicationsFolder(). Apps that do not use this API are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.
{
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34779.json",
"cwe_ids": [
"CWE-78"
]
}{
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "38.8.6"
},
{
"introduced": "39.0.0"
},
{
"fixed": "39.8.1"
},
{
"introduced": "40.0.0"
},
{
"fixed": "40.8.0"
}
],
"cpe": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*",
"source": "CPE_RANGE"
}[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"132086010140792919138208237161901714095",
"324848010678122819133429707446298175601",
"232732722155780242468197587968111093452",
"191503459847526554230123038276869791519"
]
},
"id": "CVE-2026-34779-0fc59eea",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"file": "shell/browser/notifications/platform_notification_service.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 115.0,
"function_hash": "82341144211605073495315918430661873234"
},
"id": "CVE-2026-34779-2dde5c71",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8",
"target": {
"function": "Browser::SetAsDefaultProtocolClient",
"file": "shell/browser/browser_linux.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 733.0,
"function_hash": "175984606223393446076883997290339098880"
},
"id": "CVE-2026-34779-354827aa",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8",
"target": {
"function": "Browser::SetAsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1186.0,
"function_hash": "68250451954765914529555384948311246821"
},
"id": "CVE-2026-34779-486406dc",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8",
"target": {
"function": "Browser::RemoveAsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 281.0,
"function_hash": "321435091063339474574139275787138494940"
},
"id": "CVE-2026-34779-4bcf2b4b",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"function": "ToastEventHandler::Invoke",
"file": "shell/browser/notifications/win/windows_toast_notification.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 172.0,
"function_hash": "309664838045549687053342345248981234302"
},
"id": "CVE-2026-34779-7540d693",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"function": "Notification::NotificationDismissed",
"file": "shell/browser/notifications/notification.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"288753042424669607551237503352936949706",
"241523161178316095342564918450075488713",
"318553708741945767626611335961545702991",
"78159843799449973130703286278380803962"
]
},
"id": "CVE-2026-34779-77dff4e2",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"file": "shell/browser/api/electron_api_notification.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"178412093225961153259853259794501535488",
"234789064471048285372030959292422834872",
"553863069170419135382870544703885212",
"51528561994810814695748500854429539529",
"337892798180592358990929345725835485746",
"266427063939616550362720671214856158130",
"175035989549418441255216158337115730267"
]
},
"id": "CVE-2026-34779-7db28084",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"file": "shell/browser/notifications/win/windows_toast_notification.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"7955221524269951469545866656010226521",
"139542135799777733956995556344605752364",
"140276132622858736681508960976149731077",
"80285646582331236829471548039570939434"
]
},
"id": "CVE-2026-34779-853e829b",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"file": "shell/browser/notifications/notification.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"312134141504721587325547756813884717155",
"238641136969974590059358028997585094084",
"124452021777773130581569892042041242794",
"243803249126622090118389261537301435330"
]
},
"id": "CVE-2026-34779-a501f00b",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"file": "shell/browser/notifications/notification_delegate.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"184001071477640657346456013551722397714",
"285668318726846033667932124619028269519",
"314957172723790408012662599810195089716",
"4517750117920272910953900469464815953",
"321294864450645829895715185959011147038",
"177408552723683954668510149833806496102",
"60310313236459951343689554621996677488",
"310409286819299739101286034455357087335",
"188425286791056336369690276215264213619",
"266986245836037430376719900754930259625",
"60310313236459951343689554621996677488",
"310409286819299739101286034455357087335"
]
},
"id": "CVE-2026-34779-b4c40c8e",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8",
"target": {
"file": "shell/browser/browser_win.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 71.0,
"function_hash": "88200846979177747101052407743826445247"
},
"id": "CVE-2026-34779-b806f105",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"function": "Notification::NotificationClosed",
"file": "shell/browser/api/electron_api_notification.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"260432305565188720774320473196314341923",
"334270560813533467464039160557033392559",
"35192039691071152136950982098365127489"
]
},
"id": "CVE-2026-34779-bf97cb8f",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8",
"target": {
"file": "shell/browser/browser.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"168477483023980236894774079564256179740",
"120591530035547590376345695593028510910",
"287703235042020718697344900005833442140",
"79524099051086166592493852609095961088",
"39538603236634876488930068352779111002",
"286126886422000462295626452239097757401",
"209858025069869986480066377373189965926",
"138185895275594626417956315158450728222",
"285609270383540029742982815560702152217",
"17297005053126020885978291009464847621",
"263439810505672934553031241598385686748"
]
},
"id": "CVE-2026-34779-d23d34c9",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8",
"target": {
"file": "shell/browser/browser_linux.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"57091761162372167441997243932069369719",
"139467101515551557893745183973111771089",
"148288767550464201986939322682459884147",
"268461582712617073537525257834049657858",
"106184347562513450236971598357404008264",
"276196451503965926378153345272103361953",
"209352198640994034316976330131828904214",
"95787503736654878625834293153430670949"
]
},
"id": "CVE-2026-34779-da0afa31",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8",
"target": {
"file": "shell/browser/browser.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"267862687275570911734214577067190013146",
"310183483271895590135328096533617151978",
"146989492553776126536846034963253932129",
"278191427536314618838021550407022740556",
"175411878298230533289291050283975393991"
]
},
"id": "CVE-2026-34779-f8556379",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"file": "shell/browser/api/electron_api_notification.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"214835406730665583301012487156137836041",
"173560486338033507601640280240746855878",
"290789215601936837039207858631440398145",
"244101867337963237035513652473713909525",
"224165566686308325378015977928463232339",
"151557872337821834202764352641737098737"
]
},
"id": "CVE-2026-34779-fb4c6528",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/de61f6c5e8ae56bc115edbfd7ffd07c85424670c",
"target": {
"file": "shell/browser/notifications/notification.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 643.0,
"function_hash": "42732246160536796049773581149226801294"
},
"id": "CVE-2026-34779-fbfaedd4",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8",
"target": {
"function": "Browser::IsDefaultProtocolClient",
"file": "shell/browser/browser_win.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 573.0,
"function_hash": "45250681603630778623217806006703361834"
},
"id": "CVE-2026-34779-ffea4a6c",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/fbc489c43be82f0fc331560ae678a39aeaea38c8",
"target": {
"function": "Browser::IsDefaultProtocolClient",
"file": "shell/browser/browser_linux.cc"
}
}
]
"2026-08-07T21:53:41Z"
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34779.json"