CVE-2026-34769

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls. Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.

• CWE-88
• CWE-912
• CWE-88

• https://github.com/electron/electron/security/advisories/GHSA-9wfr-w7mm-pc7fVendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-34769
• https://bugzilla.redhat.com/show_bug.cgi?id=2455004
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34769.json

Published

Apr 4, 2026

Last Modified

Jul 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34763Rack is a modular Ruby web server interface. Prior to versio…5.3
• CVE-2026-34764Electron is a framework for writing cross-platform desktop a…5.5
• CVE-2026-34765Electron is a framework for writing cross-platform desktop a…8.8
• CVE-2026-34766Electron is a framework for writing cross-platform desktop a…5.4
• CVE-2026-34767Electron is a framework for writing cross-platform desktop a…6.5
• CVE-2026-34768Electron is a framework for writing cross-platform desktop a…7.8
• CVE-2026-3477The PZ Frontend Manager plugin for WordPress is vulnerable t…5.3
• CVE-2026-34770Electron is a framework for writing cross-platform desktop a…8.8
• CVE-2026-34771Electron is a framework for writing cross-platform desktop a…8.8
• CVE-2026-34772Electron is a framework for writing cross-platform desktop a…8.8
• CVE-2026-34773Electron is a framework for writing cross-platform desktop a…7.5
• CVE-2026-34774Electron is a framework for writing cross-platform desktop a…8.1