Use After Free Affecting electron package, versions <38.8.6>=39.0.0-alpha.1 <39.8.0>=40.0.0-alpha.2 <40.7.0>=41.0.0-alpha.1 <41.0.0-beta.7
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ELECTRON-15876710
- published3 Apr 2026
- disclosed3 Apr 2026
- creditUnknown
Introduced: 3 Apr 2026
NewCVE-2026-34772 (opens in a new tab)How to fix?
Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7 or higher.
Overview
electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.
Affected versions of this package are vulnerable to Use After Free in the download save dialog callback process. An attacker can cause a crash or memory corruption by triggering session destruction while a native save-file dialog is open and then dismissing the dialog.
Note:
This is only exploitable if the application allows downloads and programmatically destroys sessions at runtime.
Workaround
This vulnerability can be mitigated by avoiding session destruction while a download save dialog may be open and by canceling pending downloads before tearing down sessions.