Security readout for executives and security teams
Plain-English summary
This affects Electron desktop apps only in a narrow pattern: the app must expose WebCodecs VideoFrame objects from a preload script through contextBridge. If an attacker can run JavaScript in the page, such as through XSS, they may cross Electron’s context isolation boundary and reach APIs intended to stay isolated.
Executive priority
Prioritize patching affected Electron apps that display untrusted content or expose powerful preload APIs. The issue is high severity but conditional, so triage depends on whether the application bridges VideoFrame objects and whether attackers can reach renderer JavaScript execution.
Technical view
Electron 39, 40, and 41 prerelease ranges before the named patched releases allow a context isolation bypass when VideoFrame objects are transferred through contextBridge.exposeInMainWorld(). Impact can include access to isolated-world capabilities, including Node.js APIs exposed to preload code.
Likely exposure
Exposure is likely limited to Electron applications using affected versions and explicitly bridging VideoFrame objects to the main world. Apps that do not pass, return, or resolve VideoFrame objects through contextBridge are stated as not affected.
Exploitation context
The sources describe exploitation as requiring attacker-controlled JavaScript in the main world, such as XSS, and user interaction per CVSS. The bundle does not report active exploitation, and KEV is false.
Researcher notes
The key research question is whether a target preload boundary exposes VideoFrame through contextBridge. Avoid broad assumptions: Electron apps without this bridge pattern are not affected according to the advisory. No exploit-in-the-wild evidence is present in the supplied sources.
Mitigation direction
- Upgrade Electron to 39.8.0, 40.7.0, 41.0.0-beta.8, or later applicable releases.
- Stop passing VideoFrame objects through contextBridge until the application is patched.
- Audit preload APIs exposed with contextBridge.exposeInMainWorld().
- Reduce renderer XSS exposure, especially where untrusted content is displayed.
- Check Electron and downstream vendor guidance for product-specific updates.
Validation and detection
- Inventory Electron versions across desktop applications and packaged builds.
- Search preload code for contextBridge.exposeInMainWorld() usage.
- Confirm no preload API passes, returns, or resolves VideoFrame objects.
- Verify patched Electron versions are present in shipped artifacts.
- Review renderer inputs and routes that could allow JavaScript execution.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1188: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-501: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-668: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-34780 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H1.66GitHub_MCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H1.36redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Base CVSS 3.1 score
8HighVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-04-04T01:00:52.288Z: Reported to Red Hat.
- 2026-04-04T00:02:02.224Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/electron/electron/security/advisories/GHSA-jfqg-hf23-qpw2CVE reference, GitHub_M · x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-34780CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2455020CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34780.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Initialization of a Resource with an Insecure Default
Initialization of a Resource with an Insecure Default represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Trust Boundary Violation
Trust Boundary Violation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Exposure of Resource to Wrong Sphere
Exposure of Resource to Wrong Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.