---
id: "CVE-2026-114124"
kind: "vulnerability"
aliases: ["CVE-2026-114124", "GHSA-h3v5-h239-pg29"]
title: "Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry"
severity: "low"
cvss: 3.9000000953674316
epss: 0.001509999972768128
exploited: false
status: "open"
category: "runtime"
products: [{"name": "electron", "fixed": ["42.11.6"], "affected": "< 42.11.6", "ecosystem": "npm"}, {"name": "electron", "fixed": ["43.7.3"], "affected": ">= 43.0.0-alpha.1, < 43.7.3", "ecosystem": "npm"}, {"name": "electron", "fixed": ["44.4.3"], "affected": ">= 44.0.0-alpha.1, < 44.4.3", "ecosystem": "npm"}, {"name": "electron", "fixed": ["45.0.0-alpha.9"], "affected": ">= 45.0.0-alpha.1, < 45.0.0-alpha.9", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-125", "electron", "macos", "offscreen-rendering", "runtime"]
not_affected_if: ["already-patched-version", "no-offscreen-rendering", "non-macos"]
published_at: "2026-10-21T18:17:24+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T21:57:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h3v5-h239-pg29", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114124", "first_seen_at": "2026-10-23T21:57:29+00:00"}]
---

# Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Electron's main process does not fully validate frame geometry supplied by the GPU process when offscreen rendering is used on macOS. An attacker who already has code execution in the GPU process can make the app read out-of-bounds memory, leaking data or crashing it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:electron affected < 42.11.6 fixed 42.11.6
- npm:electron affected >= 43.0.0-alpha.1, < 43.7.3 fixed 43.7.3
- npm:electron affected >= 44.0.0-alpha.1, < 44.4.3 fixed 44.4.3
- npm:electron affected >= 45.0.0-alpha.1, < 45.0.0-alpha.9 fixed 45.0.0-alpha.9

## How to check

Search the app for webPreferences.offscreen or offscreen: true and confirm it runs on macOS.
Check the installed version with npm ls electron.

## Fix

Upgrade electron to 42.11.6, 43.7.3, 44.4.3, or 45.0.0-alpha.9 depending on your release line; no app-side workaround exists.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-h3v5-h239-pg29
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114124

## From the sources

### Impact
In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing `paint` event images, disclosing memory or crashing the app. GHSA-pfmc-3mgc-p6fp covers the same issue on the other capture paths.

Apps are only affected if they use offscreen rendering (`webPreferences.offscreen`) on macOS and an attacker has separately gained code execution in the GPU process. Apps that do not use offscreen rendering are not affected.

### Workarounds
There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions
* `45.0.0-alpha.9`
* `44.4.3`
* `43.7.3`
* `42.11.6`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_