CVE-2026-34773
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Electron on Windows does not validate the protocol name in app.setAsDefaultProtocolClient() before writing to the registry. Apps passing untrusted input as the protocol name may allow an attacker to write to arbitrary registry subkeys, potentially hijacking existing protocol handlers.
Risk Assessment
An attacker can hijack system protocol handlers, potentially leading to malware execution when a link is clicked.
Recommendation
Update Electron to version 38.8.6, 39.8.1, 40.8.1, or 41.0.0. Use only hardcoded protocol names.
Original NVD description (English source)
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, on Windows, app.setAsDefaultProtocolClient(protocol) did not validate the protocol name before writing to the registry. Apps that pass untrusted input as the protocol name may allow an attacker to write to arbitrary subkeys under HKCU\Software\Classes\, potentially hijacking existing protocol handlers. Apps are only affected if they call app.setAsDefaultProtocolClient() with a protocol name derived from external or untrusted input. Apps that use a hardcoded protocol name are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.