Electron enables desktop applications to exchange objects between a renderer process and a preload script via the contextBridge API. The description indicates that in earlier releases objects copied across the boundary honored prototype setters, which implies that an attacker can inject malicious properties into the prototype chain of objects passed from untrusted content. Based on this, it is inferred that such prototype pollution could lead to arbitrary code execution or privilege escalation within the preload environment, because the preload code may use unsuspecting properties to perform sensitive operations. The weakness is a classic prototype‑pollution flaw (CWE‑1321).

Any Electron installation using a build older than 39.8.9, 40.9.2, 41.2.2, or 42.0.0‑beta.4 is vulnerable. The affected product is the Electron framework for cross‑platform desktop applications.

The CVSS score of 5.4 reflects a moderate severity due to the need for local, untrusted input to flow to the preload script. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that attested exploitation is not currently known. Based on the description, it is inferred that an attacker could exploit the flaw by delivering a crafted object from renderer to preload, which would enable prototype pollution and potentially compromise the entire application without requiring user interaction. The risk is lower for applications that restrict or validate all objects passed to preload, yet any lack of validation creates a viable attack path.