Electron, a framework for building desktop applications, is impacted by a flaw that allows an attacker to inject arbitrary HTTP response headers when the application registers custom protocol handlers or modifies response headers via webRequest.onHeadersReceived. If the application reflects attacker‑controlled input into a header name or value, the attacker may add new headers that alter cookie handling, violate content‑security policies, or modify cross‑origin access controls, thereby compromising the confidentiality or integrity of user data.

The vulnerability affects Electron versions prior to 38.8.6, 39.8.3, 40.8.3, and 41.0.3. Applications built with these older Electron releases that use protocol.handle(), protocol.registerSchemesAsPrivileged(), or webRequest.onHeadersReceived and allow reflected user input into response headers are susceptible. Updated releases in the mentioned version series contain the fix.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score of less than 1% suggests low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack surface likely requires an attacker who can influence header values, such as through malicious protocol data or local code execution. If such influence is possible, the injected headers can subvert security controls within the application territory.