AIKIDO-2026-939384
electron is vulnerable to Use After Free
88
High Risk
This Affects:
electronTL;DR
electron's bundled WebRTC Pipewire cursor path on Linux contains a race around shared cursor data. Crafted page content that drives WebRTC capture can reach the faulty lifetime handling. Pre-fix builds can hit use-after-free memory corruption in the media stack. The backport serializes access to the Pipewire cursor data to remove the race.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and ship electron desktop apps on Linux.
Background info
electron is vulnerable to Use After Free in versions 40.0.0 - 40.10.2 and 41.0.0 - 41.7.1.
How to fix this
Upgrade the electron library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant