CVE-2026-34765

CVE-2026-34765 is a window context isolation flaw in Electron framework versions prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5. The vulnerability allows renderers to incorrectly access and navigate child windows opened by unrelated renderers when they share the same target name, potentially inheriting elevated permissions set by setWindowOpenHandler. This affects applications that maintain multiple top-level windows with differing trust levels and delegate elevated webPreferences to child windows. The vulnerability carries a HIGH CVSS score of 8.8 with a network-based attack vector, low attack complexity, and no user interaction required. An authenticated attacker can achieve high impact across confidentiality, integrity, and availability. While the base configuration requires specific app architecture, exploitation escalates to arbitrary code execution if affected applications additionally configure child windows with nodeIntegration: true or sandbox: false. The vulnerability is currently listed on the KEV Catalog Active list, indicating active exploitation in the wild. However, the EPSS score of 0.00022 suggests minimal community exploitation relative to other CVEs. The flaw is addressable through prompt patching to one of the four fixed Electron versions, and applications not using elevated child window privileges or operating with single top-level windows are unaffected.