This vulnerability occurs because Electron does not block usage of compromised eMudhra intermediate certificates. An attacker who possesses a certificate issued through one of these intermediates and can intercept traffic can impersonate the TLS server presented to an Electron application. The issue is classified under CWE‑299.

Affected products are Electron applications built with versions prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0‑beta.6. These releases rely on Chromium networking, Node.js TLS, https, and fetch modules, which do not reject compromised eMudhra intermediates. Any distribution of Electron based on those versions is vulnerable until upgraded to the listed patched releases.

The CVSS score of 7.4 indicates high severity, but the EPSS score is unavailable, so the likely exploitation probability is unknown. The catalog does not list it in KEV, suggesting no confirmed public exploits. The attack vector is remote network; an attacker only needs a compromised intermediate certificate and ability to intercept client traffic. Because the vulnerability acts entirely on the client side, the scope is limited to the end‑user application, but the impact can allow data disclosure and credential theft. Prompt patching is therefore advised.