Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Electron bug bounty programs

electronjs.org Updated

Electron runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
12
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Electron runs.

  • Electron

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial
    First response
    6 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

12 targets. 6 excluded.

  • https://www.electronjs.org

    Web

  • Custom protocol registration and handling, protocol.handle, webRequest interception and the deep-link path from an operating system URL handler into the app

    Products and areas

  • Electron Forge and the packaging tooling where a defect there changes what ships to end users

    Products and areas

  • Electron's SECURITY.md asks for a private report through the repository advisory tab and publishes no component exclusion list, so the whole runtime below is inside it. There is no scope document narrower than the project itself

    Products and areas

  • Fuses and the packaging integrity features: runAsNode, enableNodeCliInspectArguments, onlyLoadAppFromAsar, ASAR integrity and code signing checks

    Products and areas

  • Navigation and window creation: will-navigate, setWindowOpenHandler, webview, BrowserView and nested frame handling

    Products and areas

  • The auto-updater across all platforms, covering update-feed validation, signature verification and the install step

    Products and areas

  • The IPC surface, covering ipcMain, ipcRenderer, the webContents API and the message channels that carry structured data between processes

    Products and areas

  • The main-to-renderer boundary in full: contextBridge, context isolation, the preload environment and every way an isolated world can reach the privileged one

    Products and areas

  • The native desktop APIs the runtime hands to app code: shell.openExternal, dialog, clipboard, desktopCapturer, powerMonitor and notification handling

    Products and areas

  • The Node.js integration surface Electron exposes, including module loading, require reachability from web content and the ASAR filesystem shim

    Products and areas

  • The sandbox integration and the process model, including how renderer, utility and GPU processes are spawned and what each inherits

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Attacks that require the attacker to already run arbitrary native code on the machine as the same user

  • Bugs in Node.js core rather than in Electron's integration of it

  • Bugs in the bundled Chromium itself, which belong to Google's Chrome VRP and are paid there. Report them upstream

  • Findings specific to a single shipping product such as GitHub Desktop, Slack or VS Code, which belong to those vendors' own programmes

  • Insecure configuration in an application built on Electron: an app that turns off contextIsolation or enables nodeIntegration for remote content has made a choice, and that is the app vendor's defect

  • Reports against an Electron major that is no longer supported

Recent changes

Reward and scope changes across every Electron program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Electron products, from the NVD.

Search NVD
  • CVE-2026-102677 High

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the

  • CVE-2026-102674 High

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the

  • CVE-2026-102675 High

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue compl

  • CVE-2026-102676 High

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than

  • CVE-2026-102673 High

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popup

  • CVE-2026-70612 Medium

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made av

  • CVE-2026-70611 Medium

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder

  • CVE-2026-70608 High

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that e

About this page

This page gathers every public program listed under electronjs.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.