CVE-2026-34767

CVE-2026-34767 describes an HTTP response header injection vulnerability in the Electron framework, affecting applications that register custom protocol handlers or modify response headers if attacker-controlled input is reflected. Rated Medium (CVSS 5.9) with High Attack Complexity, this flaw could allow remote attackers to inject headers, impacting cookies, Content Security Policy, or cross-origin access controls. Successful exploitation requires user interaction and specific application configurations. There is currently no evidence of active exploitation, no public exploit code available, and minimal community discussion. Affected Electron versions prior to 38.8.6, 39.8.3, 40.8.3, and 41.0.3 should be updated.