Electron's chrome.tabs.query() allowed extensions to receive the URL and title of every tab in the host application even when the extension did not declare the "tabs" permission or host permissions for that site. This unintentionally exposed the browsing context of all webContents within the Electron session to untrusted extensions. The weakness can be classified as an information‑disclosure vulnerability based on improper privilege checking (CWE-862). The impact is the leaking of URLs and titles, which could be used for phishing, profiling, or other social‑engineering attacks.

All Electron applications built on or earlier than Electron version 42.11.0, 43.5.0, 44.1.0, or the pre‑release 45.0.0‑alpha.3, if they load extensions via session.extensions.loadExtension without using the "tabs" permission or a host permission that matches the extension's origin. Electron itself is the vendor, and the affected product is the Electron framework used to package desktop applications.

The CVSS score of 3.1 classifies the issue as low severity, and the EPSS score is not reported, suggesting a low predicted exploitation rate. The vulnerability is limited to the local environment where the Electron application runs; an attacker would need to supply or influence the loading of a malicious or compromised extension within that application's session. The issue is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nonetheless, the presence of an untrusted extension presents a clear attack surface for leaking sensitive URL and title data across the application's tabs.