{"id":"CVE-2026-113797","kind":"vulnerability","aliases":["CVE-2026-113797","GHSA-98mx-cjp9-gchm"],"related":[],"title":"Electron: Extension tabs.query returns tab URLs and titles without the tabs permission","description":"### Impact\n`chrome.tabs.query()` returned each tab's `url` and `title` to extensions that held neither the `tabs` permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session.\n\nApps are only affected if they load extensions (`session.extensions.loadExtension`) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.\n\n### Workarounds\nDo not load untrusted or unvalidated extensions. In general you should only load trusted extensions.\n\n### Fixed Versions\n* `45.0.0-alpha.4`\n* `44.1.1`\n* `43.5.1`\n* `42.11.1`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","summary":"Electron's extension API let any loaded extension call chrome.tabs.query and read the URL and title of every tab in its session without the tabs permission. An attacker who gets a malicious extension loaded can see which pages the user has open.","severity":"low","cvss":3.1,"epss":0.004860000219196081,"exploited":false,"exploited_at":null,"products":[{"name":"electron","fixed":["45.0.0-alpha.4"],"affected":">= 45.0.0-alpha.1, < 45.0.0-alpha.4","ecosystem":"npm"},{"name":"electron","fixed":["44.1.1"],"affected":">= 44.0.0-alpha.1, < 44.1.1","ecosystem":"npm"},{"name":"electron","fixed":["43.5.1"],"affected":">= 43.0.0-alpha.1, < 43.5.1","ecosystem":"npm"},{"name":"electron","fixed":["42.11.1"],"affected":"< 42.11.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-862","desktop-apps","electron","node","package"],"not_affected_if":["electron-below-affected-range","no-extensions-loaded","only-trusted-extensions"],"how_to_check":"Run `npm ls electron` to find the Electron version, and check whether the app calls session.extensions.loadExtension or session.loadExtension.\nIf it loads extensions, list them and confirm each one is trusted.","fix":"Upgrade electron to 45.0.0-alpha.4, 44.1.1, 43.5.1 or 42.11.1, matching your major line.\nUntil then, stop loading untrusted extensions.","status":"open","published_at":"2026-10-21T17:18:24+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:03:34+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T20:03:34Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade electron to 45.0.0-alpha.4, 44.1.1, 43.5.1 or 42.11.1, matching your major line.\nUntil then, stop loading untrusted extensions.","summary":"Electron's extension API let any loaded extension call chrome.tabs.query and read the URL and title of every tab in its session without the tabs permission. An attacker who gets a malicious extension loaded can see which pages the user has open.","category":"package","who_cares":["electron","desktop-apps","node"],"confidence":0.85,"analyst_note":"","how_to_check":"Run `npm ls electron` to find the Electron version, and check whether the app calls session.extensions.loadExtension or session.loadExtension.\nIf it loads extensions, list them and confirm each one is trusted.","needs_analyst":false,"not_affected_if":["no-extensions-loaded","only-trusted-extensions","electron-below-affected-range"],"severity_if_unknown":"low"},"cost_usd":0.000406,"input_tokens":2375,"output_tokens":336,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-113797':15A,23A '-2026':14A,22A '-862':29B '42.11.1':164C '43.5.1':163C '44.1.1':162C '45.0.0':160C '98mx':18A 'advisori':177C 'affect':118C,141C 'alpha.4':161C 'api':39B 'app':32B,115C,130C 'attack':63B 'call':44B 'chrome.tabs.query':45B,79C 'cjp9':19A 'comment':174C 'could':103C 'cve':13A,21A 'cwe':28B 'desktop':31B 'desktop-app':30B 'electron':1A,24A,25A,26A,27A,33B,36B 'email':178C 'everi':53B,110C 'extens':2A,38B,43B,68B,88C,102C,122C,134C,149C,157C 'fix':158C 'fulli':128C 'gchm':20A 'general':151C 'get':65B 'ghsa':17A 'ghsa-98mx-cjp9-gchm':16A 'held':90C 'host':97C 'impact':78C 'inform':167C 'let':40B 'load':42B,69B,101C,121C,132C,145C,155C 'mailto':182C 'malici':67B 'match':96C 'neither':91C 'node':34B 'one':138C 'open':77B 'packag':35B 'page':73B 'permiss':12A,61B,94C,98C 'question':172C 'read':47B,104C 'return':4A,80C 'security@electronjs.org':181C,183C 'see':71B 'session':57B,114C 'session.extensions.loadextension':123C 'tab':5A,11A,54B,60B,82C,93C 'tabs.query':3A 'titl':8A,51B,86C,108C 'trust':129C,137C,156C 'untrust':146C 'unvalid':148C 'url':6A,49B,84C,106C 'us':179C 'user':75B 'version':159C 'webcont':111C 'without':9A,58B 'workaround':142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-98mx-cjp9-gchm","url":"https://github.com/advisories/GHSA-98mx-cjp9-gchm","severity":"low","published_at":"2026-10-22T16:46:33+00:00","modified_at":"2026-10-22T16:46:35+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-113797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113797","severity":null,"published_at":"2026-10-21T17:18:24+00:00","modified_at":"2026-10-22T17:29:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}