Cross-Site Scripting Vulnerability in Electron Framework Affecting Multiple Versions
CVE-2026-115570
What is CVE-2026-115570?
The Electron framework was found to lack proper filtering for compromised eMudhra intermediate certificates, leading to potential TLS server impersonation. Attackers with a valid certificate from these intermediates could intercept network traffic and pose as a legitimate server to the affected applications. This vulnerability affects users prior to the updates available in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6. It's crucial for developers and users to update to the latest versions to safeguard their applications against this security risk.
Affected Version(s)
electron >= 45.0.0-alpha.1, < 45.0.0-beta.6 < 45.0.0-alpha.1, 45.0.0-beta.6
electron >= 44.0.0-alpha.1, < 44.9.1 < 44.0.0-alpha.1, 44.9.1
electron >= 43.0.0-alpha.1, < 43.8.1 < 43.0.0-alpha.1, 43.8.1