CVE-2026-34772: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34772 is a use-after-free (UAF) vulnerability in the Electron framework affecting apps that allow downloads and programmatically destroy sessions. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, potentially leading to a crash or memory corruption. The vulnerability was published on April 2–3, 2026, by VerteDinde via the GitHub Security Advisory GHSA-9w97-2464-8783. Affected versions include all Electron releases before 38.8.6, 39.0.0-alpha.1 through 39.7.x, 40.0.0-alpha.1 through 40.6.x, and 41.0.0-alpha.1 through 41.0.0-beta.6. The CVSS v3.1 base score is 5.8 (Moderate) per the official advisory, though some sources report a higher score of 8.8 (GitHub Advisory, Electron Advisory).

The vulnerability is classified as CWE-416 (Use After Free). The root cause is a race condition in Electron's download handling: when an application programmatically destroys a session object while a native OS save-file dialog is still open for an in-progress download, the session's memory is freed. When the user subsequently dismisses the dialog, the callback dereferences the now-freed session memory, triggering the UAF condition. Exploitation requires local attack vector access, high attack complexity (timing the session teardown with the dialog), no privileges, and user interaction (dismissing the dialog) (GitHub Advisory, Electron Advisory). Applications that do not destroy sessions at runtime or do not permit downloads are not affected.

Successful exploitation can result in application crashes, memory corruption, or potential information disclosure from the affected Electron application process. The confidentiality impact is rated High (sensitive in-process data may be exposed via memory corruption), while integrity and availability impacts are Low and Low respectively per the official CVSS scoring. The vulnerability is scoped to the affected application process and does not directly enable lateral movement, but memory corruption primitives in Electron apps — which often run with elevated privileges or access sensitive user data — could be leveraged for further exploitation in a targeted attack (GitHub Advisory, Electron Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (GitHub Advisory). The EPSS score is approximately 0.017% (4th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity due to the timing dependency between session teardown and an active save dialog, further limiting practical exploitability.

Electron has released patched versions across all supported release lines: 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.7 (Electron Advisory). Developers should update their Electron dependency to one of these versions immediately. As a temporary workaround for applications that cannot be updated immediately, avoid programmatically destroying sessions while a download save dialog may be open, and cancel any pending downloads before initiating session teardown. IBM has also issued a security bulletin for MongoDB Enterprise Advanced with IBM products affected by this CVE (IBM Advisory).

The advisory was published by Electron maintainer VerteDinde and received routine coverage across vulnerability tracking platforms including VulDB, CVEFeed, and CIRCL. An informal write-up was published at infinitsec.net shortly after disclosure. Social media activity was limited to automated CVE tracking accounts on Bluesky. No significant researcher commentary or broader media coverage has been identified beyond standard vulnerability database aggregation.