A flaw was found in Electron. This vulnerability allows untrusted guest content loaded inside an embedded web view to run background worker tasks with elevated privileges. By enabling Node.js integration within background web workers, an attacker can bypass security restrictions set by the host application that disable Node.js access. Successful exploitation can lead to privilege escalation and arbitrary code execution within the context of the host application.
Last checked: 2026-09-30 21:40 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 19:50 UTC)
Fix evidence last checked: 2026-09-30 19:07 UTC