Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2026-115570

Electron: Mitigation for compromised eMudhra intermediate certificates

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application. This issue is fixed in versions 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

electron electron

  • >= 45.0.0-alpha.1, < 45.0.0-beta.6affected
  • >= 44.0.0-alpha.1, < 44.9.1affected
  • >= 43.0.0-alpha.1, < 43.8.1affected
  • < 42.11.16affected

References