CVE-2026-34772：electron UAF漏洞，影响≤38.8.6版本

CVE-2026-34772 影响允许下载并以编程方式销毁用户会话的 Electron 应用程序。该漏洞在于潜在的 use-after-free 情况。如果在下载的本机保存文件对话框打开时会话被销毁，则关闭对话框可能会导致访问已释放的内存，从而可能导致应用程序崩溃或内存损坏。此漏洞对于管理文件下载并实现动态会话终止机制的应用程序尤其相关。CVSS 严重程度评分为 5.8，表明存在中等风险。

Applications built with Electron that allow downloads and programmatically destroy user sessions are at risk. This includes desktop applications, progressive web apps (PWAs), and any Electron-based software that handles file downloads and user authentication. Specifically, applications with poorly implemented session management or download handling are particularly vulnerable.

• windows / supply-chain: Monitor Electron processes (Get-Process electron) for unusual memory usage patterns. Check scheduled tasks for suspicious scripts that might be manipulating Electron sessions.

Get-Process electron | Select-Object Name, CPU, WorkingSet

• linux / server: Use journalctl to filter for Electron application crashes or errors related to memory access.

journalctl -u electron -g 'memory access' --since '1 hour'

• generic web: Examine web application logs for errors related to Electron components or download processes. Check for unusual network requests associated with Electron applications.

1. 2026-04-03Disclosure

   disclosure

1. 已保留2026-03-30
2. 发布日期2026-04-03
3. 修改日期2026-04-06
4. EPSS 更新日期2026-04-11

针对 CVE-2026-34772 的主要缓解措施是在下载保存对话框处于活动状态时避免销毁用户会话。如果下载正在进行中，建议在关闭会话之前取消下载。升级到 Electron 版本 38.8.6 是最终解决方案，因为此版本包含此漏洞的修复。此外，重要的是检查应用程序代码以识别和更正下载过程中早期会话终止的任何情况。彻底的测试有助于检测和防止此类问题。