Security readout for executives and security teams
Plain-English summary
Some Electron desktop apps can mishandle certain browser-style permission requests. If an app waits before answering a fullscreen, pointer-lock, or keyboard-lock permission request, and the requesting page changes or the window closes, Electron may access freed memory. That can cause crashes or memory corruption.
Executive priority
Treat as a high-priority update for Electron-based desktop products that use asynchronous permission handling. Scope is narrower than all Electron apps, so prioritize inventory and targeted upgrades before broader emergency response.
Technical view
CVE-2026-34771 is a use-after-free in Electron WebContents permission callbacks. Affected apps use asynchronous session.setPermissionRequestHandler() for fullscreen, pointer-lock, or keyboard-lock. If navigation or window closure occurs before the stored callback is invoked, freed memory may be dereferenced. Patched Electron versions are available.
Likely exposure
Exposure is limited to Electron apps on affected release lines that register an asynchronous permission request handler. Apps without a permission handler, or handlers that respond synchronously, are described as not affected in the provided sources.
Exploitation context
No provided source reports active exploitation, and the bundle marks KEV as false. Exploitation is constrained by high complexity and user interaction, requiring a pending permission callback plus navigation or window closure. Impact may include crash or memory corruption.
Researcher notes
The relevant condition is lifecycle invalidation of a requesting frame or window while a stored permission callback remains pending. Analysis should focus on affected release lines and async handler behavior, not all Electron permission handling.
Mitigation direction
- Upgrade Electron 38.x to 38.8.6 or later.
- Upgrade Electron 39.x to 39.8.0 or later.
- Upgrade Electron 40.x to 40.7.0 or later.
- Upgrade Electron 41 beta to 41.0.0-beta.8 or later.
- Review asynchronous permission handlers for affected permission types.
- Check Electron and downstream vendor guidance before shipping fixes.
Validation and detection
- Inventory Electron versions embedded in desktop applications.
- Search code for session.setPermissionRequestHandler() usage.
- Confirm whether handlers answer asynchronously or synchronously.
- Identify fullscreen, pointer-lock, and keyboard-lock permission paths.
- Verify packaged builds use patched Electron versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-364: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-34771 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9GitHub_MCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-04T00:00:54.679Z: Reported to Red Hat.
- 2026-04-03T23:47:23.171Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/electron/electron/security/advisories/GHSA-8337-3p73-46f4CVE reference, GitHub_M · x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-34771CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2454995CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34771.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Signal Handler Race Condition
Signal Handler Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.