CVE-2026-70598: Electron Information Disclosure Vulnerability

CVE-2026-70598 Overview

CVE-2026-70598 is an out-of-bounds read vulnerability [CWE-125] in Electron, the framework used to build cross-platform desktop applications with JavaScript, HTML, and CSS. The main process fails to fully validate offscreen rendering (OSR) frame data received from the GPU process. A compromised GPU process can force the main process to read memory beyond the shared-memory mapping while producing paint event images. Successful exploitation discloses process memory or crashes the application. The issue is fixed in Electron 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.

Critical Impact
A compromised GPU process can trigger out-of-bounds reads in the Electron main process, leading to memory disclosure or application crashes.

Affected Products

Electron versions prior to 39.8.10
Electron versions 40.x prior to 40.9.0
Electron versions 41.x prior to 41.2.1 and 42.0.0 prior to 42.0.0-beta.3

Discovery Timeline

2026-08-05 - CVE-2026-70598 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70598

Vulnerability Analysis

Electron's offscreen rendering pipeline relies on shared memory between the GPU process and the main process to deliver rendered frames. The main process consumes pixel_size and region metadata from the GPU process and constructs a Skia canvas backed by the shared memory mapping. Prior to the fix, the main process trusted these values without confirming that the shared-memory region was large enough to back the declared pixel geometry.

An attacker who has already compromised the GPU process can supply crafted geometry values. The main process then reads past the end of the shared-memory mapping while producing paint event images. This yields memory disclosure or an application crash.

Root Cause

The root cause is missing validation of attacker-controlled geometry against the size of the shared-memory backing store in shell/browser/osr/osr_host_display_client.cc. The code computed expected_bytes for the declared pixel_size but did not compare that value against region.GetSize() or shm_mapping_.size() before constructing the Skia canvas.

Attack Vector

Exploitation requires an already-compromised GPU process within the target Electron application. The attacker uses that foothold to send malformed OSR frame metadata to the main process. The vulnerability is local, requires high privileges, and has high attack complexity, limiting practical exploitation to chained-attack scenarios.

text

   if (!region.IsValid())
     return;
 
-  // Make sure |pixel_size| is sane.
+  // |pixel_size| and |region| arrive from the GPU process. Reject geometry that
+  // overflows or that claims more pixels than the region can actually back so a
+  // hostile peer cannot make the canvas read past the shared-memory mapping.
   size_t expected_bytes;
   bool size_result = viz::ResourceSizes::MaybeSizeInBytes(
       pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes);
-  if (!size_result)
+  if (!size_result || region.GetSize() < expected_bytes) {
+    DLOG(ERROR) << "Shared memory region too small for pixel_size "
+                << pixel_size.ToString();
     return;
+  }
 
 #if defined(WIN32)
   canvas_ = skia::CreatePlatformCanvasWithSharedSection(
       pixel_size.width(), pixel_size.height(), false,
-      region.GetPlatformHandle(), skia::CRASH_ON_FAILURE);
+      region.GetPlatformHandle(), skia::RETURN_NULL_ON_FAILURE);
 #else
   shm_mapping_ = region.Map();
-  if (!shm_mapping_.IsValid()) {
+  if (!shm_mapping_.IsValid() || shm_mapping_.size() < expected_bytes) {
     DLOG(ERROR) << "Failed to map shared memory region";
+    shm_mapping_ = base::WritableSharedMemoryMapping();
     return;
   }

Source: GitHub Electron Commit 2c24640. The patch rejects geometry whose expected_bytes exceeds the shared-memory region size, switches the Windows canvas allocator to RETURN_NULL_ON_FAILURE, and clears the mapping when validation fails.

Detection Methods for CVE-2026-70598

Indicators of Compromise

Unexpected crashes of Electron-based applications with stack traces referencing osr_host_display_client or Skia canvas allocation.
GPU process termination or repeated GPU process restarts preceding main-process crashes.
Log entries containing Failed to map shared memory region or Shared memory region too small for pixel_size after the patch is applied.

Detection Strategies

Inventory installed Electron applications and identify versions below 39.8.10, 40.9.0, and 41.2.1.
Monitor endpoint telemetry for anomalous child-process behavior in Electron apps, particularly renderer or GPU processes spawning unexpected code paths.
Correlate application crash reports with recent GPU-process exploitation attempts targeting Chromium-based components.

Monitoring Recommendations

Collect and centralize Electron application crash dumps for triage against the vulnerable OSR code paths.
Track patch state of bundled Electron runtimes across managed desktop software, including third-party apps that embed Electron.
Alert on repeated SIGSEGV or access-violation crashes in Electron main processes across a fleet.

How to Mitigate CVE-2026-70598

Immediate Actions Required

Upgrade Electron to 39.8.10, 40.9.0, 41.2.1, or 42.0.0-beta.3 and rebuild all downstream applications.
Audit deployed desktop applications for embedded Electron versions and prioritize apps that enable offscreen rendering.
Apply Chromium-level GPU sandbox hardening to reduce the likelihood of GPU-process compromise.

Patch Information

The fix is available in Electron 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3. Details are documented in the GitHub Security Advisory GHSA-pfmc-3mgc-p6fp and the corresponding upstream commit.

Workarounds

Disable offscreen rendering (webPreferences.offscreen) in BrowserWindow configurations where the feature is not required.
Restrict local access to systems running vulnerable Electron applications until patched builds are deployed.
Enforce application allow-listing to limit exposure of Electron apps that cannot be updated immediately.

bash

# Example: create a BrowserWindow with offscreen rendering disabled
# in the application's main process source
#
#   const win = new BrowserWindow({
#     webPreferences: {
#       offscreen: false
#     }
#   });
#
# Verify installed Electron runtime version
npm ls electron
npx electron --version