Use-After-Free Vulnerability in Electron Framework for Desktop Applications
CVE-2026-34771
What is CVE-2026-34771?
The Electron framework, utilized for developing cross-platform desktop applications, has a vulnerability that can be exploited when apps register an asynchronous session permission request handler. The issue arises during fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the window is closed while the permission handler remains pending, accessing the stored callback can cause a dereference of freed memory. This situation may result in application crashes or potential memory corruption. Developers should ensure to upgrade to the patched versions 38.8.6, 39.8.0, 40.7.0, or 41.0.0-beta.8 to mitigate risks associated with this vulnerability.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
electron < 38.8.6 < 38.8.6
electron >= 39.0.0-alpha.1, < 39.8.0 < 39.0.0-alpha.1, 39.8.0
electron >= 40.0.0-alpha.1, < 40.7.0 < 40.0.0-alpha.1, 40.7.0