CVE-2026-34772: Electron: Use-after-free in download save dialog callback

April 3, 2026 (updated April 6, 2026)

Apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected.

References

github.com/advisories/GHSA-9w97-2464-8783
github.com/electron/electron
github.com/electron/electron/security/advisories/GHSA-9w97-2464-8783
nvd.nist.gov/vuln/detail/CVE-2026-34772

Code Behaviors & Features

Detect and mitigate CVE-2026-34772 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →