CVE-2026-34772CWE-416

Electron: Use-after-free in download save dialog callback

Medium · published April 3, 2026

CVSS v3.1
5.8
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption. Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00242 · 14.6th percentile
Weakness
CWE-416 · Use After Free
Published
2026-04-03T23:49Z
EPSS history
Timeline
  • 03 APR 23:49Z
    Electron: Use-after-free in download save dialog callback
    cvelistv5