CVE-2026-34778: Electron: Service worker can spoof executeJavaScript IPC replies

April 3, 2026 (updated April 6, 2026)

A service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data.

Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions.

References

github.com/advisories/GHSA-xj5x-m3f3-5x3h
github.com/electron/electron
github.com/electron/electron/security/advisories/GHSA-xj5x-m3f3-5x3h
nvd.nist.gov/vuln/detail/CVE-2026-34778

Code Behaviors & Features

Detect and mitigate CVE-2026-34778 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →