CVE-2026-115570

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.

• CWE-299

• https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc
• https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad
• https://github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e7ad20
• https://github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e800499
• https://github.com/electron/electron/pull/55127
• https://github.com/electron/electron/pull/55128
• https://github.com/electron/electron/pull/55129
• https://github.com/electron/electron/pull/55130
• https://github.com/electron/electron/releases/tag/v42.11.16
• https://github.com/electron/electron/releases/tag/v43.8.1
• https://github.com/electron/electron/releases/tag/v44.9.1
• https://github.com/electron/electron/releases/tag/v45.0.0-beta.6
• https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11555A vulnerability was identified in D-Link DGS-1100-08PD 1.00.…7.5
• CVE-2026-115557Python has added a denylist for known compromised certificat…9.4
• CVE-2026-11556A security flaw has been discovered in Tenda F451 1.0.0.7/1.…8.8
• CVE-2026-115567Tokio is a runtime for writing applications with Rust. In 1.…5.8
• CVE-2026-115569Fallow is a codebase intelligence tool for TypeScript and Ja…3.3
• CVE-2026-11557A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9…8.8
• CVE-2026-115572pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-11558A security vulnerability has been detected in CodeAstro Payr…6.3
• CVE-2026-115580pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-115585pypdf is a free and open-source pure-python PDF library. Pri…7.1
• CVE-2026-115586virtualenv is a tool for creating isolated virtual python en…7.1
• CVE-2026-11559A vulnerability was detected in CodeAstro Payroll System 1.0…6.3