Live › vulnerability › CVE-2026-114124
Go to dashboardElectron's main process does not fully validate frame geometry supplied by the GPU process when offscreen rendering is used on macOS. An attacker who already has code execution in the GPU process can make the app read out-of-bounds memory, leaking data or crashing it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| electron | npm | < 42.11.6 | 42.11.6 |
| electron | npm | >= 43.0.0-alpha.1, < 43.7.3 | 43.7.3 |
| electron | npm | >= 44.0.0-alpha.1, < 44.4.3 | 44.4.3 |
| electron | npm | >= 45.0.0-alpha.1, < 45.0.0-alpha.9 | 45.0.0-alpha.9 |
npm ls electronUpgrade electron to 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9 depending on your release line; no app-side workaround exists.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths.
Apps are only affected if they use offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.
There are no app side workarounds, you must update to a patched version of Electron.
45.0.0-alpha.944.4.343.7.342.11.6If you have any questions or comments about this advisory, email us at [email protected]
This page as .md · .json · in your agent: get_signal("CVE-2026-114124")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.