Electron allows desktop applications to access low‑level GPU‑supplied frame data through webContents.beginFrameSubscription. Prior to the fixed releases, the main process did not fully validate frame geometry sent from the GPU process. An attacker who first gains code execution in the GPU process could supply malformed frame geometry. This causes the main process to read memory beyond the bounds of the expected frame buffer, leading to disclosure of arbitrary memory contents or a crash while rendering captured frame images. The flaw is described by CWE‑125, an out-of-bounds read.

The affected product is the Electron framework. Vulnerable versions include any release before 42.11.6, 43.7.3, 44.4.3, or 45.0.0‑alpha.9. All Electron builds that use webContents.beginFrameSubscription without applying the 42.11.6+ mitigations are potentially exposed. Updating to any of the released patch versions or newer resolves the issue.

The CVSS score of 3.9 indicates low overall severity, and no EPSS data is currently available, suggesting limited observable exploitation. KEV does not list this vulnerability. The attack requires separate code execution in the GPU process and the use of beginFrameSubscription, which limits the attacker’s reach. However, once the conditions are met, the main process can read sensitive memory areas or crash, compromising confidentiality or availability for the affected application.