Electron exposes a use‑after‑free when offscreen rendering with GPU shared textures is enabled. The release() callback for a paint‑event texture may be invoked after its backing native state has been freed, causing the main process to dereference freed memory. This can lead to a crash or memory corruption and is classified as CWE‑416.

The issue affects Electron releases from 33.0.0‑alpha.1 up to, but not including, 39.8.5, 40.8.5, 41.1.0, and 42.0.0‑alpha.5. Applications that enable offscreen rendering with shared textures via webPreferences.offscreen: { useSharedTexture: true } are vulnerable. Projects that do not enable shared‑texture offscreen rendering are not impacted.

With a CVSS score of 2.3 the vulnerability has low severity and the exploit probability is not quantified. It is not listed in the CISA KEV catalogue, suggesting no known widespread exploitation. The attack vector is inferred to be local or application‑level, requiring an attacker to run malicious code within an Electron application that uses the vulnerable offscreen rendering configuration. Because the issue leads only to crashes or memory corruption, the potential damage is limited to destabilization of the application unless an attacker can leverage the vulnerability to execute arbitrary code.