Live › vulnerability › CVE-2026-114122
Go to dashboardElectron's main process does not fully validate frame geometry received from the GPU process when an app uses webContents.beginFrameSubscription. A process that already has code execution in the GPU process can make the main process read out-of-bounds memory, leaking data or crashing the app.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| electron | npm | < 42.11.6 | 42.11.6 |
| electron | npm | >= 43.0.0-alpha.1, < 43.7.3 | 43.7.3 |
| electron | npm | >= 44.0.0-alpha.1, < 44.4.3 | 44.4.3 |
| electron | npm | >= 45.0.0-alpha.1, < 45.0.0-alpha.9 | 45.0.0-alpha.9 |
42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9, matching your release lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frame data received from the GPU process for webContents.beginFrameSubscription was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app.
Apps are only affected if they use webContents.beginFrameSubscription and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected.
There are no app side workarounds, you must update to a patched version of Electron.
45.0.0-alpha.944.4.343.7.342.11.6If you have any questions or comments about this advisory, email us at [email protected]
This page as .md · .json · in your agent: get_signal("CVE-2026-114122")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.