Live › vulnerability › CVE-2026-113797
Go to dashboardElectron's extension API let any loaded extension call chrome.tabs.query and read the URL and title of every tab in its session without the tabs permission. An attacker who gets a malicious extension loaded can see which pages the user has open.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| electron | npm | >= 45.0.0-alpha.1, < 45.0.0-alpha.4 | 45.0.0-alpha.4 |
| electron | npm | >= 44.0.0-alpha.1, < 44.1.1 | 44.1.1 |
| electron | npm | >= 43.0.0-alpha.1, < 43.5.1 | 43.5.1 |
| electron | npm | < 42.11.1 | 42.11.1 |
Run npm ls electron to find the Electron version, and check whether the app calls session.extensions.loadExtension or session.loadExtension.
If it loads extensions, list them and confirm each one is trusted.
45.0.0-alpha.4, 44.1.1, 43.5.1 or 42.11.1, matching your major lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
chrome.tabs.query() returned each tab's url and title to extensions that held neither the tabs permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session.
Apps are only affected if they load extensions (session.extensions.loadExtension) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.
Do not load untrusted or unvalidated extensions. In general you should only load trusted extensions.
45.0.0-alpha.444.1.143.5.142.11.1If you have any questions or comments about this advisory, email us at [email protected]
This page as .md · .json · in your agent: get_signal("CVE-2026-113797")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.