Arbitrary Write Vulnerability in Electron Framework for Desktop Applications

CVE-2026-34773

What is CVE-2026-34773?

The Electron framework, which facilitates the development of cross-platform desktop applications, contains a vulnerability that allows untrusted protocol names to be processed without validation before they are written to the Windows registry. This flaw occurs in the function app.setAsDefaultProtocolClient(protocol), enabling potential exploitation where an attacker could write to arbitrary subkeys under HKCU\Software\Classes. Applications that derive protocol names from external or untrusted sources are at risk of compromising existing protocol handlers. To mitigate this issue, users are urged to update to versions 38.8.6, 39.8.1, 40.8.1, or 41.0.0.

References