A service worker in an Electron application can fabricate reply messages on the internal IPC channel used by webContents.executeJavaScript(). This allows attacker‑controlled data to resolve the promise in the main process, potentially altering security‑sensitive decisions that rely on that data. The weakness involves improper authentication control (CWE‑290) and delivery of false trustworthy data (CWE‑345).

The issue affects Electron releases prior to 38.8.6, 39.8.1, 40.8.1, and 41.0.0. Applications that register service workers and subsequently call webContents.executeJavaScript() or webFrameMain.executeJavaScript() and use the result for security checks are impacted. Upstream Electron versions are identified as electron:electron in the CNA feed.

The CVSS score is 5.9, reflecting moderate severity. EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker control a service worker within the application’s context and that the application processes the executeJavaScript result in a security‑sensitive manner. Impact is therefore contingent on application logic, rather than a universal privilege escalation.