{"id":"CVE-2026-114122","kind":"vulnerability","aliases":["CVE-2026-114122","GHSA-3qxv-5xgr-q7w9"],"related":[],"title":"Electron: Frame subscription trusts GPU-supplied frame geometry","description":"### Impact\nFrame data received from the GPU process for `webContents.beginFrameSubscription` was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing the captured frame images, disclosing memory or crashing the app.\n\nApps are only affected if they use `webContents.beginFrameSubscription` and an attacker has separately gained code execution in the GPU process. Apps that do not subscribe to captured frames are not affected.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `45.0.0-alpha.9`\n* `44.4.3`\n* `43.7.3`\n* `42.11.6`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","summary":"Electron's main process does not fully validate frame geometry received from the GPU process when an app uses webContents.beginFrameSubscription. A process that already has code execution in the GPU process can make the main process read out-of-bounds memory, leaking data or crashing the app.","severity":"low","cvss":3.9000000953674316,"epss":0.0014100000262260437,"exploited":false,"exploited_at":null,"products":[{"name":"electron","fixed":["42.11.6"],"affected":"< 42.11.6","ecosystem":"npm"},{"name":"electron","fixed":["43.7.3"],"affected":">= 43.0.0-alpha.1, < 43.7.3","ecosystem":"npm"},{"name":"electron","fixed":["44.4.3"],"affected":">= 44.0.0-alpha.1, < 44.4.3","ecosystem":"npm"},{"name":"electron","fixed":["45.0.0-alpha.9"],"affected":">= 45.0.0-alpha.1, < 45.0.0-alpha.9","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-125","desktop-apps","electron","runtime"],"not_affected_if":["already-patched-version","no-beginframesubscription-use"],"how_to_check":"Run: grep -rn \"beginFrameSubscription\" in your app source to see whether you use it.\nCheck your Electron version in package.json or node_modules/electron/package.json against the fixed versions.","fix":"Upgrade Electron to 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9, matching your release line. No app-side workaround exists.","status":"open","published_at":"2026-10-21T17:18:25+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:03:27+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T20:03:27Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Electron to 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9, matching your release line. No app-side workaround exists.","summary":"Electron's main process does not fully validate frame geometry received from the GPU process when an app uses webContents.beginFrameSubscription. A process that already has code execution in the GPU process can make the main process read out-of-bounds memory, leaking data or crashing the app.","category":"runtime","who_cares":["electron","desktop-apps"],"confidence":0.85,"analyst_note":"","how_to_check":"Run: grep -rn \"beginFrameSubscription\" in your app source to see whether you use it.\nCheck your Electron version in package.json or node_modules/electron/package.json against the fixed versions.\nunknown","needs_analyst":false,"not_affected_if":["no-beginFrameSubscription-use","already-patched-version"],"severity_if_unknown":"low"},"cost_usd":0.000405,"input_tokens":2385,"output_tokens":333,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-114122':12A,20A '-125':26B '-2026':11A,19A '3qxv':15A '42.11.6':179C '43.7.3':178C '44.4.3':177C '45.0.0':175C '5xgr':16A 'advisori':192C 'affect':129C,156C 'alpha.9':176C 'alreadi':55B 'app':29B,49B,79B,125C,126C,146C,161C 'attack':136C 'bound':72B,112C 'captur':117C,152C 'caus':103C 'code':57B,140C 'comment':189C 'compromis':99C 'could':102C 'crash':77B,123C 'cve':10A,18A 'cwe':25B 'data':75B,82C 'desktop':28B 'desktop-app':27B 'disclos':120C 'electron':1A,21A,22A,23A,24A,30B,32B,172C 'email':193C 'execut':58B,141C 'fix':173C 'frame':2A,8A,40B,81C,118C,153C 'fulli':38B,92C 'gain':139C 'geometri':9A,41B 'ghsa':14A 'ghsa-3qxv-5xgr-q7w9':13A 'gpu':6A,45B,61B,86C,100C,144C 'gpu-suppli':5A 'imag':119C 'impact':80C 'inform':182C 'leak':74B 'mailto':197C 'main':34B,66B,96C,105C 'make':64B 'memori':73B,113C,121C 'must':165C 'out-of-bound':69B,109C 'patch':169C 'process':35B,46B,53B,62B,67B,87C,97C,101C,106C,145C 'produc':115C 'q7w9':17A 'question':187C 'read':68B,108C 'receiv':42B,83C 'runtim':31B 'security@electronjs.org':196C,198C 'separ':138C 'side':162C 'subscrib':150C 'subscript':3A 'suppli':7A 'trust':4A 'updat':166C 'us':194C 'use':50B,132C 'valid':39B,93C 'version':170C,174C 'webcontents.beginframesubscription':51B,89C,133C 'workaround':157C,163C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-3qxv-5xgr-q7w9","url":"https://github.com/advisories/GHSA-3qxv-5xgr-q7w9","severity":"low","published_at":"2026-10-22T16:46:06+00:00","modified_at":"2026-10-22T16:46:07+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114122","severity":null,"published_at":"2026-10-21T17:18:25+00:00","modified_at":"2026-10-22T17:29:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}