CVE-2026-34773: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34773 is a registry key path injection vulnerability in the Electron framework's app.setAsDefaultProtocolClient() API on Windows, formally titled "Registry key path injection in app.setAsDefaultProtocolClient on Windows." The flaw allows an attacker to write to arbitrary subkeys under HKCU\Software\Classes\, potentially hijacking existing protocol handlers, when an Electron application passes untrusted input as the protocol name. Affected versions include all Electron releases before 38.8.6, 39.x before 39.8.1, 40.x before 40.8.1, and 41.x before 41.0.0. The advisory was published on April 2, 2026, and assigned CVE-2026-34773 on April 4, 2026. The CVSS v3.1 base score is 4.7 (Moderate) per the official GitHub Security Advisory (GitHub Advisory, Electron Advisory).

The root cause is improper input validation (CWE-20) combined with injection of special elements into a downstream component (CWE-74). On Windows, app.setAsDefaultProtocolClient(protocol) writes the supplied protocol name directly to the Windows registry without sanitizing or validating the input against an allowlist pattern. An attacker who can influence the protocol name argument — for example, by injecting path separators or special characters — can cause the application to write registry entries to arbitrary subkeys under HKCU\Software\Classes\, enabling protocol handler hijacking. Exploitation requires local access with low privileges and high attack complexity, as the attacker must be able to supply untrusted input to the vulnerable API call. Applications that use a hardcoded, static protocol name are not affected (GitHub Advisory, Electron Advisory).

Successful exploitation results in a high integrity impact with no confidentiality or availability loss. An attacker can overwrite or create arbitrary registry subkeys under HKCU\Software\Classes\, allowing them to hijack existing Windows protocol handlers (e.g., http://, mailto:, or custom application protocols). This could redirect protocol invocations to attacker-controlled executables, enabling privilege escalation, persistent code execution under the victim's user context, or phishing attacks via malicious URI handler redirection. The scope is limited to the current user's registry hive, constraining lateral movement potential (GitHub Advisory, Electron Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-34773 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.026% (8th percentile), indicating a low near-term exploitation probability. Exploitation requires local access with low privileges and high attack complexity, further limiting practical exploitability (GitHub Advisory).

1. Identify a vulnerable Electron application: Locate an Electron app (versions before 38.8.6, 39.8.1, 40.8.1, or 41.0.0 on Windows) that calls app.setAsDefaultProtocolClient() with a protocol name derived from user-controlled or external input.
2. Craft a malicious protocol name: Prepare a protocol name string containing path traversal characters or subkey separators (e.g., myprotocol\..\http) designed to resolve to an existing or sensitive registry subkey under HKCU\Software\Classes\.
3. Deliver the malicious input: Supply the crafted protocol name to the vulnerable application through whatever input vector it exposes — such as a configuration file, command-line argument, IPC message, or network-delivered data that the app passes to setAsDefaultProtocolClient().
4. Trigger registry write: When the application calls app.setAsDefaultProtocolClient(maliciousProtocol), Electron writes the attacker-controlled registry path without validation, creating or overwriting the targeted subkey under HKCU\Software\Classes\.
5. Hijack protocol handler: With the registry entry modified, any subsequent invocation of the targeted protocol (e.g., clicking a link) will launch the attacker-specified executable or command, achieving code execution under the victim's user context (GitHub Advisory, Electron Advisory).

• Registry: Unexpected or modified subkeys under HKCU\Software\Classes\ with unusual names containing path separators, dots, or other special characters; protocol handler entries pointing to unexpected executables or scripts.
• Registry: New or altered shell\open\command values under HKCU\Software\Classes\<protocol>\ that reference attacker-controlled binaries.
• Logs: Windows Event Log entries (Event ID 4657 if object access auditing is enabled) showing registry key modifications under HKCU\Software\Classes\ by an Electron application process.
• Process: Electron application processes spawning unexpected child processes when a URI scheme is invoked; unusual executables launched in response to protocol handler activation.
• File System: Presence of unexpected executables or scripts referenced in modified protocol handler registry entries.

Electron has released patched versions that validate the protocol name before writing to the registry: 38.8.6, 39.8.1, 40.8.1, and 41.0.0. Application developers should upgrade to one of these fixed versions as the primary remediation. As an immediate workaround for applications that cannot be updated, developers should validate the protocol name against the regex /^[a-zA-Z][a-zA-Z0-9+.-]*$/ before passing it to app.setAsDefaultProtocolClient(), rejecting any input that does not match. Applications using only hardcoded protocol names are not affected and require no action (GitHub Advisory, Electron Advisory).

The advisory was published by the Electron security team (VerteDinde) on April 2, 2026, and IBM subsequently issued a security bulletin noting that MongoDB Enterprise Advanced with IBM is also affected by this vulnerability among others (IBM Bulletin). No significant independent researcher commentary or broad media coverage has been identified beyond standard vulnerability database aggregation.