Electron’s sandboxed preload cache was incorrectly validated, allowing a compromised renderer process to store attacker‑controlled cache entries. When a trusted preload is later invoked, the application mistakenly reuses that cached data, executing the malicious code with elevated privileges. This vulnerability is a classic example of input validation failure (CWE‑20) combined with a lack of integrity enforcement (CWE‑345), and can lead to arbitrary code execution within any Electron application that loads untrusted content.

The Electron framework (electron:electron) is affected in versions 42.3.3 through 42.10.0, as well as in 43.5.0 and 44.0.0‑beta.6. Applications built with any of these releases that allow a renderer process to load external or untrusted web content are at risk.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of < 1% indicates a very low exploitation probability, obscuring precise exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is an untrusted renderer process—either injected via malicious web content or a compromised third‑party module. Exposing an Electron application to such content can enable a local attacker to poison the preload cache and gain remote code execution privileges.