CVE-2026-34777

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content. The correct requesting URL remains available via details.requestingUrl. Apps that already check details.requestingUrl are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

• CWE-346

• https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrxVendor Advisory

Published

Apr 4, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34771Electron is a framework for writing cross-platform desktop a…8.8
• CVE-2026-34772Electron is a framework for writing cross-platform desktop a…8.8
• CVE-2026-34773Electron is a framework for writing cross-platform desktop a…7.5
• CVE-2026-34774Electron is a framework for writing cross-platform desktop a…8.1
• CVE-2026-34775Electron is a framework for writing cross-platform desktop a…9.8
• CVE-2026-34776Electron is a framework for writing cross-platform desktop a…5.3
• CVE-2026-34778Electron is a framework for writing cross-platform desktop a…6.5
• CVE-2026-34779Electron is a framework for writing cross-platform desktop a…7.8
• CVE-2026-3478The Content Syndication Toolkit plugin for WordPress is vuln…7.2
• CVE-2026-34780Electron is a framework for writing cross-platform desktop a…6.1
• CVE-2026-34781Electron is a framework for writing cross-platform desktop a…3.3
• CVE-2026-34782Zammad is a web based open source helpdesk/customer support …4.3