Electron: WebContentsのフルスクリーン、ポインターロック、キーボードロックの許可コールバックにおける解放後使用 (Use-after-free)

An attacker exploiting this vulnerability could potentially trigger a crash or memory corruption within an Electron application. This could lead to denial of service, or in more severe cases, allow for arbitrary code execution if the memory corruption overwrites critical data structures. The impact is particularly concerning for applications handling sensitive user data or operating with elevated privileges. While the description doesn't explicitly detail a remote exploitation path, a malicious website or application could trigger the vulnerability if it interacts with an Electron app that has a vulnerable permission handler registered. The blast radius depends on the privileges of the Electron application itself.

Applications built using Electron that register asynchronous session.setPermissionRequestHandler() are at risk. This includes a wide range of desktop applications, particularly those that handle user permissions or interact with system resources. Developers using Electron for cross-platform development, especially those relying on third-party libraries or components that utilize permission request handlers, should prioritize patching.

• linux / server: Monitor Electron application logs for crashes or segmentation faults. Use ps aux | grep electron to identify running Electron processes and check their resource usage for anomalies.

journalctl -u electron -f | grep -i crash

• windows / supply-chain: Use Process Monitor to observe Electron processes and identify any unusual memory access patterns or crashes. Check Autoruns for suspicious Electron-related entries.

Get-Process -Name electron | Select-Object Id, CPU, WorkingSet

• generic web: If the Electron application interacts with a web server, examine web server access logs for unusual requests that might trigger the permission request handler.

1. 2026-04-03Disclosure

   disclosure

1. 予約済み2026-03-30
2. 公開日2026-04-03
3. 更新日2026-04-08
4. EPSS 更新日2026-04-11

The primary mitigation for CVE-2026-34771 is to upgrade to Electron version 38.8.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the asynchronous session.setPermissionRequestHandler() functionality if it's not essential. Carefully review the Electron changelog for potential breaking changes before upgrading. There are no specific WAF or proxy rules that can directly address this vulnerability, as it's a code-level issue within the Electron application. Monitor Electron application logs for crashes or unexpected behavior that might indicate exploitation.