Privacy Exposure in Electron Framework for Cross-Platform Applications
CVE-2026-113797
What is CVE-2026-113797?
The Electron framework, widely used for developing cross-platform desktop applications, has a vulnerability that allows untrusted extensions to gain access to sensitive information. Specifically, prior to certain patched versions, the chrome.tabs.query() function could disclose the URL and title of active tabs to extensions that lacked necessary permissions. This flaw permits a potentially malicious extension, loaded by an untrusted application, to monitor the web contents within its session. To safeguard against this vulnerability, users are encouraged to update to the latest Electron versions.
Affected Version(s)
electron < 42.11.1 < 42.11.1
electron >= 43.0.0-alpha.1, < 43.5.1 < 43.0.0-alpha.1, 43.5.1
electron >= 44.0.0-alpha.1, < 44.1.1 < 44.0.0-alpha.1, 44.1.1