E
Vendor security profile
electronjs
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs34
Critical1
CISA KEV0
Public exploit0
Patch rate%50
Avg. CVSS6.6
12-month vulnerability rate
0
0
0
0
0
17
0
0
0
16
1
0
CVE KEV
CVE severity distribution
34toplam CVE
Critical1 (3%)
High13 (38%)
Medium17 (50%)
Low3 (9%)
Patch and exploitation view
%50
Verified patch
%0
CISA KEV
%0
Public exploit
17Patch available
0Partial
0Workaround
0Vendor: no patch
17Unknown
Latest vulnerabilities
7.8
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
E
Patch verifiedEPSS %0
5.4
CVE-2026-70612
Electron: Sandboxed iframes can launch external protocol handlers
E
Patch verifiedEPSS %0
6.9
CVE-2026-70611
Electron: DevTools embedder handler executes arbitrary files via shell open
E
Patch verifiedEPSS %0
5.4
CVE-2026-70610
Electron: contextBridge object copy honors prototype setters
E
Patch verifiedEPSS %1
5.7
CVE-2026-70609
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
E
Patch verifiedEPSS %1
7.2
CVE-2026-70608
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
E
Patch verifiedEPSS %0
5.3
CVE-2026-70607
Electron: window.open features string controls some window options considered privileged
E
Patch verifiedEPSS %1
5.9
CVE-2026-70606
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
E
Patch verifiedEPSS %0
5.9
CVE-2026-70605
Electron: HTTP redirect followed into local file loader
E
Patch verifiedEPSS %0
7.4
CVE-2026-70604
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
E
Patch verifiedEPSS %0