LOW 3.1 NVD
CVE-2026-113797
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-al
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.
References
- https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4
- https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c
- https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f
- https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921
- https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f
This low severity vulnerability with a CVSS score of 3.1 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18720 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.