- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 6 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 6 days
If nothing comes back within six business days, escalate to the OpenJS Foundation CNA at [email protected] ; the published process names that path explicitly
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://www.electronjs.org
Products and areas 11
- Custom protocol registration and handling, protocol.handle, webRequest interception and the deep-link path from an operating system URL handler into the app
- Electron Forge and the packaging tooling where a defect there changes what ships to end users
- Electron's SECURITY.md asks for a private report through the repository advisory tab and publishes no component exclusion list, so the whole runtime below is inside it. There is no scope document narrower than the project itself
- Fuses and the packaging integrity features: runAsNode, enableNodeCliInspectArguments, onlyLoadAppFromAsar, ASAR integrity and code signing checks
- Navigation and window creation: will-navigate, setWindowOpenHandler, webview, BrowserView and nested frame handling
- The auto-updater across all platforms, covering update-feed validation, signature verification and the install step
- The IPC surface, covering ipcMain, ipcRenderer, the webContents API and the message channels that carry structured data between processes
- The main-to-renderer boundary in full: contextBridge, context isolation, the preload environment and every way an isolated world can reach the privileged one
- The native desktop APIs the runtime hands to app code: shell.openExternal, dialog, clipboard, desktopCapturer, powerMonitor and notification handling
- The Node.js integration surface Electron exposes, including module loading, require reachability from web content and the ASAR filesystem shim
- The sandbox integration and the process model, including how renderer, utility and GPU processes are spawned and what each inherits
Out of scope (6)
- Attacks that require the attacker to already run arbitrary native code on the machine as the same user
- Bugs in Node.js core rather than in Electron's integration of it
- Bugs in the bundled Chromium itself, which belong to Google's Chrome VRP and are paid there. Report them upstream
- Findings specific to a single shipping product such as GitHub Desktop, Slack or VS Code, which belong to those vendors' own programmes
- Insecure configuration in an application built on Electron: an app that turns off contextIsolation or enables nodeIntegration for remote content has made a choice, and that is the app vendor's defect
- Reports against an Electron major that is no longer supported
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report privately through the Report a Vulnerability tab on electron/electron . GitHub private vulnerability reporting is enabled and it is the documented channel
-
If nothing comes back within six business days, escalate to the OpenJS Foundation CNA at the address on the policy page ; the published process names that path explicitly
-
Say which side of the Chromium line your finding sits on. A bug in the bundled Chromium belongs to Google's Chrome VRP; a bug in Electron's own code is the one this page is about
-
Name the Electron major versions affected. Several majors are supported at once and app vendors sit on different ones
-
Give a minimal reproducer app rather than a patched copy of a shipping product. A bug demonstrated only inside Slack or VS Code reads as that vendor's problem
Not accepted
-
Bugs in the bundled Chromium itself
-
Bugs in Node.js core rather than in Electron's integration of it
-
Insecure configuration in an application built on Electron
-
Findings specific to a single shipping product such as GitHub Desktop, Slack or VS Code
-
Attacks that require the attacker to already run arbitrary native code on the machine as the same user
-
Reports against an Electron major that is no longer supported
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-102677 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the | High 7.8 | 29 Sep 2026 |
| CVE-2026-102674 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the | High 8.2 | 29 Sep 2026 |
| CVE-2026-102675 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue compl | High 7.4 | 29 Sep 2026 |
| CVE-2026-102676 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than | High 8.3 | 29 Sep 2026 |
| CVE-2026-102673 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popup | High 8.2 | 29 Sep 2026 |
| CVE-2026-70612 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made av | Medium 5.4 | 5 Aug 2026 |
| CVE-2026-70611 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder | Medium 6.9 | 5 Aug 2026 |
| CVE-2026-70608 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that e | High 7.2 | 5 Aug 2026 |
| CVE-2026-70609 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has ac | Medium 5.7 | 5 Aug 2026 |
| CVE-2026-70610 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affecte | Medium 5.4 | 5 Aug 2026 |
| CVE-2026-70607 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main | Medium 5.3 | 5 Aug 2026 |
| CVE-2026-70604 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response | High 7.4 | 5 Aug 2026 |
| CVE-2026-70605 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file | Medium 5.9 | 5 Aug 2026 |
| CVE-2026-70606 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise | Medium 5.9 | 5 Aug 2026 |
| CVE-2026-70597 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rel | Medium 6.3 | 5 Aug 2026 |
| CVE-2026-70598 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory | Low 3.9 | 5 Aug 2026 |
| CVE-2026-70599 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device acce | Medium 5.9 | 5 Aug 2026 |
| CVE-2026-70600 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframe | Low 3.1 | 5 Aug 2026 |
| CVE-2026-70601 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload | High 7.5 | 5 Aug 2026 |
| CVE-2026-70602 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected | Medium 6.6 | 5 Aug 2026 |
| CVE-2026-70603 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attack | Medium 6.0 | 5 Aug 2026 |
| CVE-2026-34765 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelat | Medium 6.0 | 7 Apr 2026 |
| CVE-2026-34781 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that call clipboard.readImage() may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort | Low 2.8 | 7 Apr 2026 |
| CVE-2026-34764 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that use offscreen rendering with GPU shared textures may be vulnerable to a use-after-free. Under certain conditions, the release() callback provided on a paint event texture can outlive its backing native state, and | Low 2.3 | 6 Apr 2026 |
| CVE-2026-34780 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in | High 8.3 | 4 Apr 2026 |
| CVE-2026-34775 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. | Medium 6.8 | 4 Apr 2026 |
| CVE-2026-34776 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on macOS and Linux, apps that call app.requestSingleInstanceLock() were vulnerable to an out-of-bounds heap read when parsing a crafted second-instance message. Leaked memory could be delivered to the app's second-instance event handler. This | Medium 5.3 | 4 Apr 2026 |
| CVE-2026-34777 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps tha | Medium 5.4 | 4 Apr 2026 |
| CVE-2026-34778 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only | Medium 5.9 | 4 Apr 2026 |
| CVE-2026-34779 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder() used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleSc | Medium 6.5 | 4 Apr 2026 |
| CVE-2026-34768 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettings({openAtLogin: true}) wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory ma | Low 3.9 | 4 Apr 2026 |
| CVE-2026-34769 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow a | High 7.7 | 4 Apr 2026 |
| CVE-2026-34770 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain | High 7.0 | 4 Apr 2026 |
| CVE-2026-34771 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that register an asynchronous session.setPermissionRequestHandler() may be vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests. If the requesting frame navigates or the windo | High 7.5 | 4 Apr 2026 |
| CVE-2026-34772 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, w | Medium 5.8 | 4 Apr 2026 |
| CVE-2026-34773 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClient(protocol) did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Softwar | Medium 4.7 | 4 Apr 2026 |
| CVE-2026-34774 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 39.8.1, 40.7.0, and 41.0.0, apps that use offscreen rendering and allow child windows via window.open() may be vulnerable to a use-after-free. If the parent offscreen WebContents is destroyed while a child window remains open, subsequent paint frames on the child dereference fr | High 8.1 | 4 Apr 2026 |
| CVE-2026-34766 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, the select-usb-device event callback did not validate the chosen device ID against the filtered list that was presented to the handler. An app whose handler could be influenced to select a device ID outside the filtered set would grant | Low 3.3 | 4 Apr 2026 |
| CVE-2026-34767 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.3, 40.8.3, and 41.0.3, apps that register custom protocol handlers via protocol.handle() / protocol.registerSchemesAsPrivileged() or modify response headers via webRequest.onHeadersReceived may be vulnerable to HTTP response header injection if attacker-controlled | Medium 5.9 | 4 Apr 2026 |
| CVE-2023-44402 | Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only b | Medium 6.1 | 1 Dec 2023 |
| CVE-2023-39956 | Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that wo | Medium 6.1 | 6 Sep 2023 |
| CVE-2023-29198 | Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. This issue is only exploitable if | Medium 6.0 | 6 Sep 2023 |
| CVE-2023-23623 | Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled. i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods l | High 7.5 | 6 Sep 2023 |
| CVE-2022-36077 | The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer follow | High 7.2 | 8 Nov 2022 |
| CVE-2022-29257 | Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some comp | Medium 6.6 | 13 Jun 2022 |
| CVE-2022-29247 | Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` o | Low 2.2 | 13 Jun 2022 |
| CVE-2022-21718 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron v | Low 3.4 | 22 Mar 2022 |
| CVE-2021-39184 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases. Versions 15.0. | Medium 6.8 | 12 Oct 2021 |
| CVE-2021-32772 | Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allows the injection of HTML and JS code (cross-site scripting). Being an application made in electron, cro | High 8.8 | 3 Aug 2021 |
| CVE-2020-26272 | The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your a | Medium 5.4 | 28 Jan 2021 |
| CVE-2020-35717 | zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true). | Critical 9.0 | 1 Jan 2021 |
| CVE-2020-15215 | Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Ele | Medium 5.6 | 6 Oct 2020 |
| CVE-2020-15174 | In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox | High 7.5 | 6 Oct 2020 |
| CVE-2020-4075 | In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4. | Medium 6.8 | 7 Jul 2020 |
| CVE-2020-4076 | In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4. | High 7.8 | 7 Jul 2020 |
| CVE-2020-4077 | In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4. | High 7.7 | 7 Jul 2020 |
| CVE-2020-15096 | In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in | Medium 6.8 | 7 Jul 2020 |
| CVE-2018-15685 | GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution. | High 8.1 | 23 Aug 2018 |
| CVE-2017-16151 | Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled. | Critical 9.8 | 7 Jun 2018 |
| CVE-2018-1000136 | Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have bee | High 8.1 | 23 Mar 2018 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 36 Last 12 months 55 Lifetime Sandbox and context isolation escape 40 % IPC and webContents abuse 25 % Protocol and URL handling 20 % Fuse and packaging integrity 15 % Latest advisories Loading the feed Overview Electron packages Chromium and Node.js into a single desktop runtime, and it is what Visual Studio Code, Slack, Discord and Signal are actually built on. That is comfortably past a hundred million desktop installs, on corporate laptops and personal machines alike. The boundary that matters is Electron's own code rather than the browser inside it: context isolation, the fuses, custom protocol handlers and the webContents IPC surface decide whether untrusted web content stays inside the renderer. Google pays for the bundled Chromium and excludes embedders from that programme. GitHub's paid programme even carries an Electron asset marked ineligible for bounty. Nobody upstream pays, so sorona.xyz pays you directly on qualified, reproduced findings. In scope Electron's SECURITY.md asks for a private report through the repository advisory tab and publishes no component exclusion list, so the whole runtime below is inside it. There is no scope document narrower than the project itself The main-to-renderer boundary in full: contextBridge , context isolation, the preload environment and every way an isolated world can reach the privileged one The IPC surface, covering ipcMain , ipcRenderer , the webContents API and the message channels that carry structured data between processes The sandbox integration and the process model, including how renderer, utility and GPU processes are spawned and what each inherits Fuses and the packaging integrity features: runAsNode , enableNodeCliInspectArguments , onlyLoadAppFromAsar , ASAR integrity and code signing checks Custom protocol registration and handling, protocol.handle , webRequest interception and the deep-link path from an operating system URL handler into the app Navigation and window creation: will-navigate , setWindowOpenHandler , webview , BrowserView and nested frame handling The Node.js integration surface Electron exposes, including module loading, require reachability from web content and the ASAR filesystem shim The native desktop APIs the runtime hands to app code: shell.openExternal , dialog , clipboard , desktopCapturer , powerMonitor and notification handling The auto-updater across all platforms, covering update-feed validation, signature verification and the install step Electron Forge and the packaging tooling where a defect there changes what ships to end users Out of scope Bugs in the bundled Chromium itself, which belong to Google's Chrome VRP and are paid there. Report them upstream Bugs in Node.js core rather than in Electron's integration of it Insecure configuration in an application built on Electron: an app that turns off contextIsolation or enables nodeIntegration for remote content has made a choice, and that is the app vendor's defect Findings specific to a single shipping product such as GitHub Desktop, Slack or VS Code, which belong to those vendors' own programmes Attacks that require the attacker to already run arbitrary native code on the machine as the same user Reports against an Electron major that is no longer supported Most-valued findings Renderer to main escape: untrusted web content reaching Node or a native API despite contextIsolation and sandbox being on. This is the highest-severity class in the project and the reason Electron carries a large advisory count Context isolation defects, particularly prototype pollution or object leakage across the contextBridge that hands the isolated world a reference into the privileged one IPC handlers that trust a renderer-supplied argument, where a compromised renderer drives a privileged main-process action Fuse bypass, especially anything that re-enables runAsNode or defeats ASAR integrity, since those turn a signed application into a generic code execution vector on the user's machine Protocol handler and deep-link parsing that lets a link from a browser or a chat message reach app-privileged code Navigation controls that fail open, where will-navigate or the window-open handler can be sidestepped to load attacker content in a privileged context shell.openExternal and file-path handling that turn a URL or a filename into local command execution Auto-updater weaknesses in feed validation or signature checking, which convert a network position into persistent code execution across every install Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately through the Report a Vulnerability tab on electron/electron . GitHub private vulnerability reporting is enabled and it is the documented channel If nothing comes back within six business days, escalate to the OpenJS Foundation CNA at [email protected] ; the published process names that path explicitly Say which side of the Chromium line your finding sits on. A bug in the bundled Chromium belongs to Google's Chrome VRP; a bug in Electron's own code is the one this page is about Name the Electron major versions affected. Several majors are supported at once and app vendors sit on different ones Give a minimal reproducer app rather than a patched copy of a shipping product. A bug demonstrated only inside Slack or VS Code reads as that vendor's problem State the security posture your reproducer assumes: nodeIntegration , contextIsolation , sandbox and the relevant fuses. A finding that needs insecure settings is a documentation issue, and one that survives the secure defaults is the real thing Disclosure Coordinated privately in a GitHub security advisory on electron/electron , with the OpenJS Foundation acting as CNA and as the escalation route if the maintainers go quiet. Fixes land across the supported major branches together and publish as an advisory alongside those releases. Downstream application vendors then have to rebuild, so the real exposure window runs well past the Electron release. Hold detail until the advisory is public. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability