Is CVE-2026-34770 actively exploited?

No active exploitation of CVE-2026-34770 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34770 be exploited remotely?

No. CVE-2026-34770 requires local access to exploit.

What is the CVSS score of CVE-2026-34770?

CVE-2026-34770 has a CVSS score of 7.0 (HIGH).

HOME VULNERABILITIESCVE-2026-34770

HIGH

CVE-2026-34770

CWE-416Published: April 4, 2026· Updated: Apr 7, 2026

7.0

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:3.3th

Official Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.

NVD Source

Technical Analysis

CVE-2026-34770 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.0.

From a weakness classification perspective (CWE-416): Use-after-free vulnerabilities involve accessing memory after it has been freed, often enabling arbitrary code execution.