CVE-2026-113797
lowElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4 security-advisories@github.com
- https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c security-advisories@github.com
- https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f security-advisories@github.com
- https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921 security-advisories@github.com
- https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f security-advisories@github.com
- https://github.com/electron/electron/pull/52597 security-advisories@github.com
- https://github.com/electron/electron/pull/53353 security-advisories@github.com
- https://github.com/electron/electron/pull/53354 security-advisories@github.com
- https://github.com/electron/electron/pull/53355 security-advisories@github.com
- https://github.com/electron/electron/pull/53356 security-advisories@github.com
- https://github.com/electron/electron/releases/tag/v42.11.1 security-advisories@github.com
- https://github.com/electron/electron/releases/tag/v43.5.1 security-advisories@github.com
- https://github.com/electron/electron/releases/tag/v44.1.1 security-advisories@github.com
- https://github.com/electron/electron/releases/tag/v45.0.0-alpha.4 security-advisories@github.com
- https://github.com/electron/electron/security/advisories/GHSA-98mx-cjp9-gchm security-advisories@github.com