Detections
Analytics
CVE-2026-113797
low
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.
References
https://github.com/electron/electron/security/advisories/GHSA-98mx-cjp9-gchm
https://github.com/electron/electron/releases/tag/v45.0.0-alpha.4
https://github.com/electron/electron/releases/tag/v44.1.1
https://github.com/electron/electron/releases/tag/v43.5.1
https://github.com/electron/electron/releases/tag/v42.11.1
https://github.com/electron/electron/pull/53356
https://github.com/electron/electron/pull/53355
https://github.com/electron/electron/pull/53354
https://github.com/electron/electron/pull/53353
https://github.com/electron/electron/pull/52597
https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f
https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921
https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f
https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c
https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4