Electron extensions in versions earlier than 39.8.8, 40.9.0, 41.2.1, or 42.0.0‑beta.3 were able to use extension tab and scripting APIs that were not confined to the extension’s own session. A malicious or compromised extension loaded via session.loadExtension could navigate, script, and read content in windows belonging to a different session, effectively bypassing session isolation and enabling unauthorized data access or manipulation.

The vulnerability affects applications built with the Electron framework that load Chrome extensions through the session.loadExtension API and rely on separate sessions for isolation. Versions before 39.8.8, 40.9.0, 41.2.1, and 42.0.0‑beta.3 are impacted; upgrading to any of the listed fixed releases eliminates the issue.

The CVSS score of 6.6 indicates moderate severity. The EPSS score is not available, so the exact likelihood of exploitation is unclear, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a malicious extension and have the application load it via session.loadExtension. Once loaded, the attacker could read or script windows from other sessions, potentially exposing sensitive data or altering application behavior. The risk is moderate, but patching is recommended to prevent unauthorised access across sessions.