---
id: "CVE-2026-113797"
kind: "vulnerability"
aliases: ["CVE-2026-113797", "GHSA-98mx-cjp9-gchm"]
title: "Electron: Extension tabs.query returns tab URLs and titles without the tabs permission"
severity: "low"
cvss: 3.1
epss: 0.004860000219196081
exploited: false
status: "open"
category: "package"
products: [{"name": "electron", "fixed": ["45.0.0-alpha.4"], "affected": ">= 45.0.0-alpha.1, < 45.0.0-alpha.4", "ecosystem": "npm"}, {"name": "electron", "fixed": ["44.1.1"], "affected": ">= 44.0.0-alpha.1, < 44.1.1", "ecosystem": "npm"}, {"name": "electron", "fixed": ["43.5.1"], "affected": ">= 43.0.0-alpha.1, < 43.5.1", "ecosystem": "npm"}, {"name": "electron", "fixed": ["42.11.1"], "affected": "< 42.11.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-862", "desktop-apps", "electron", "node", "package"]
not_affected_if: ["electron-below-affected-range", "no-extensions-loaded", "only-trusted-extensions"]
published_at: "2026-10-21T17:18:24+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T21:57:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-98mx-cjp9-gchm", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113797", "first_seen_at": "2026-10-23T21:57:29+00:00"}]
---

# Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

Electron's extension API let any loaded extension call chrome.tabs.query and read the URL and title of every tab in its session without the tabs permission. An attacker who gets a malicious extension loaded can see which pages the user has open.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:electron affected >= 45.0.0-alpha.1, < 45.0.0-alpha.4 fixed 45.0.0-alpha.4
- npm:electron affected >= 44.0.0-alpha.1, < 44.1.1 fixed 44.1.1
- npm:electron affected >= 43.0.0-alpha.1, < 43.5.1 fixed 43.5.1
- npm:electron affected < 42.11.1 fixed 42.11.1

## How to check

Run `npm ls electron` to find the Electron version, and check whether the app calls session.extensions.loadExtension or session.loadExtension.
If it loads extensions, list them and confirm each one is trusted.

## Fix

Upgrade electron to 45.0.0-alpha.4, 44.1.1, 43.5.1 or 42.11.1, matching your major line.
Until then, stop loading untrusted extensions.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-98mx-cjp9-gchm
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113797

## From the sources

### Impact
`chrome.tabs.query()` returned each tab's `url` and `title` to extensions that held neither the `tabs` permission nor matching host permissions, so any loaded extension could read the URL and title of every webContents in its session.

Apps are only affected if they load extensions (`session.extensions.loadExtension`) that they do not fully trust. Apps that load no extensions, or only trusted ones, are not affected.

### Workarounds
Do not load untrusted or unvalidated extensions. In general you should only load trusted extensions.

### Fixed Versions
* `45.0.0-alpha.4`
* `44.1.1`
* `43.5.1`
* `42.11.1`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_