Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.
Published: 2026-10-21
Score: 3.9 Low
EPSS: < 1% Very Low
KEV: No
Impact: Memory Disclosure or Application Crash
Action: Apply Patch
AI Analysis

Impact

Electron’s off‑screen rendering pipeline on macOS uses geometry supplied by the GPU process to construct frame buffers. In older Electron releases, this geometry was not fully validated by the main process. An attacker who manages to gain code execution within the GPU process can supply malicious geometry data that causes the main process to read out‑of‑bounds memory during paint operations. The result is either disclosure of data from the main process memory or a crash that disrupts the application’s availability.

Affected Systems

The vulnerability affects Electron releases before 42.11.6, 43.7.3, 44.4.3, and 45.0.0‑alpha.9 when running on macOS. Applications built with these Electron versions could be impacted if the GPU process is compromised.

Risk and Exploitability

The CVSS score of 3.9 scores this issue as low impact, and no EPSS data is available, suggesting a modest exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attacking requires separate code execution in the GPU process, which is a non‑trivial prerequisite, so the overall risk to production systems is considered low.

Generated by OpenCVE AI on October 22, 2026 at 03:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Electron to version 42.11.6 or newer (including 43.7.3, 44.4.3, or 45.0.0‑alpha.9) to apply the security fix.
  • Rebuild or reinstall your application after updating Electron so that all binaries and web assets reference the patched engine.
  • If possible, enforce sandboxing or eliminate privileged code execution on the GPU process to reduce the likelihood of the prerequisite being met.

Generated by OpenCVE AI on October 22, 2026 at 03:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-h3v5-h239-pg29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
History

Sun, 25 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Electron
Electron electron
Vendors & Products Electron
Electron electron

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering was not fully validated by the main process. An attacker who had separately gained code execution in the GPU process could provide inconsistent frame geometry and cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the application. This issue is fixed in versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9.
Title Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 3.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L'}

Subscriptions

Electron Electron
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-23T15:11:35.835Z

Reserved: 2026-10-20T21:53:58.472Z

Link: CVE-2026-114124

cve-icon Vulnrichment

Updated: 2026-10-23T14:47:55.215Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-21T18:17:24.800

Modified: 2026-10-23T15:17:25.250

Link: CVE-2026-114124

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T11:15:04Z

Weaknesses