ASAR Integrity Bypass in Electron Framework for Windows Applications
CVE-2024-46992

7.8HIGH

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
1 July 2025

What is CVE-2024-46992?

The Electron framework is vulnerable to an ASAR integrity bypass specifically on Windows platforms. This vulnerability affects versions 30.0.0-alpha.1 to before 30.0.5 and 31.0.0-alpha.1 to before 31.0.0-beta.1, impacting applications that have enabled the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses. The vulnerability arises when an application is launched from a writable filesystem, allowing potential exploitation by an attacker with write access to the .app bundle. This issue does not impact macOS applications using the same fuses. The vulnerability has been addressed in the updated versions 30.0.5 and 31.0.0-beta.1, which provide the necessary patch.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

electron >= 30.0.0-alpha.1, < 30.0.5 < 30.0.0-alpha.1, 30.0.5

electron >= 31.0.0-alpha.1, < 31.0.0-beta.1 < 31.0.0-alpha.1, 31.0.0-beta.1

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM
https://www.electronjs.org/docs/latest/tutorial/fuses
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.