CVE-2026-34775: Node.js Integration in Electron

The core of this vulnerability lies in the incorrect scoping of the nodeIntegrationInWorker web preference within Electron. Specifically, in certain process-sharing scenarios, workers spawned in frames where nodeIntegrationInWorker is explicitly set to false can still inadvertently receive Node.js integration. This effectively bypasses the intended security restriction. An attacker could exploit this to inject and execute malicious JavaScript code within the worker context, potentially gaining control over the application and accessing sensitive data. The impact is amplified if the application handles sensitive user data or interacts with external systems, as the attacker could leverage the compromised worker to perform actions on behalf of the application.

1. Reserved2026-03-30
2. Published2026-04-03
3. Modified2026-04-08
4. EPSS updated2026-04-11

The primary mitigation for CVE-2026-34775 is to upgrade to Electron version 38.8.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the nodeIntegrationInWorker feature entirely if it's not essential for the application's functionality. Alternatively, carefully review and restrict the permissions granted to workers to minimize the potential impact of a successful exploitation. While a direct WAF rule is unlikely to be effective, monitoring for unusual worker activity and unexpected Node.js calls within the application can provide an early warning sign of compromise. After upgrading, confirm the fix by verifying that workers spawned with nodeIntegrationInWorker: false do not have access to Node.js APIs.