GHSA-8337-3p73-46f4

Source

https://github.com/advisories/GHSA-8337-3p73-46f4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-8337-3p73-46f4/GHSA-8337-3p73-46f4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8337-3p73-46f4

Aliases

CVE-2026-34771

Published

2026-04-03T02:40:24Z

Modified

2026-04-03T02:51:18.459772Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Details

Impact

Apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not set a permission request handler, or whose handler responds synchronously, are not affected.

Workarounds

Respond to permission requests synchronously, or deny fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

Fixed Versions

41.0.0-beta.8
40.7.0
39.8.0
38.8.6

For more information

If there are any questions or comments about this advisory, please email security@electronjs.org

Database specific

{
    "cwe_ids": [
        "CWE-416"
    ],
    "github_reviewed": true,
    "nvd_published_at": null,
    "severity": "HIGH",
    "github_reviewed_at": "2026-04-03T02:40:24Z"
}

References

Affected packages

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

38.8.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-8337-3p73-46f4/GHSA-8337-3p73-46f4.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

39.0.0-alpha.1

Fixed

39.8.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-8337-3p73-46f4/GHSA-8337-3p73-46f4.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

40.0.0-alpha.1

Fixed

40.7.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-8337-3p73-46f4/GHSA-8337-3p73-46f4.json"

npm / electron

Package

Name: electron; View open source insights on deps.dev
Purl: pkg:npm/electron

Affected ranges

Type: SEMVER
Events: Introduced

41.0.0-alpha.1

Fixed

41.0.0-beta.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-8337-3p73-46f4/GHSA-8337-3p73-46f4.json"