An undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls.
Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected.
Do not spread untrusted input into webPreferences. Use an explicit allowlist of permitted preference keys when constructing BrowserWindow or webContents options from external configuration.
41.0.0-beta.840.7.039.8.038.8.6If there are any questions or comments about this advisory, send an email to [email protected]
| Score | Percentile |
|---|---|
| 0.02% | 5.96% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 7.8 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-9wfr-w7mm-pc7f ↗ |
| CVE | CVE-2026-34769 ↗ |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| npm | electron | < 38.8.6 | 38.8.6 | — |
| npm | electron | >= 39.0.0-alpha.1, < 39.8.0 | 39.8.0 | — |
| npm | electron | >= 40.0.0-alpha.1, < 40.7.0 | 40.7.0 | — |
| npm | electron | >= 41.0.0-alpha.1, < 41.0.0-beta.8 | 41.0.0-beta.8 | — |