CVE-2026-70598

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.10 Electron versions prior to 40.9.0 Electron versions prior to 41.2.1 Electron versions prior to 42.0.0-beta.3

Description In offscreen rendering mode, the main process does not fully validate frame data received from the GPU process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, which may lead to memory disclosure or application crashes. This issue only affects applications that use offscreen rendering via webPreferences.offscreen and where an attacker has already achieved code execution within the GPU process.

Recommendations Update to version 39.8.10. Update to version 40.9.0. Update to version 41.2.1. Update to version 42.0.0-beta.3.