The vulnerability is a use‑after‑free triggered during the paint callback of a child window rendered offscreen. When an offscreen WebContents parent is destroyed while a child window remains open, subsequent paint frames on that child dereference freed memory. The result can be a crash or memory corruption, potentially allowing exploitation to compromise application integrity or stability.

The issue affects Electron releases prior to 39.8.1, 40.7.0, and 41.0.0. Applications that enable offscreen rendering (webPreferences.offscreen: true) and allow child windows via window.open() are at risk. All other Electron applications that do not use offscreen rendering or explicitly deny child windows are not affected.

The CVSS score of 8.1 classifies it as high severity, and the very low EPSS score (<1%) indicates a low probability of exploitation in the wild. It is not listed in CISA’s KEV catalog. Although the description only states a crash or memory corruption, the use‑after‑free could allow malicious code to run if an attacker crafts a suitable payload. The attack likely requires the application to be executed with the vulnerable settings, so threat vectors are limited to user‑controlled applications.