Is CVE-2026-34778 actively exploited?

No active exploitation of CVE-2026-34778 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34778 be exploited remotely?

Yes. CVE-2026-34778 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34778?

CVE-2026-34778 has a CVSS score of 5.9 (MEDIUM).

HOME VULNERABILITIESCVE-2026-34778

MEDIUM

CVE-2026-34778

CWE-290Published: April 4, 2026· Updated: Apr 7, 2026

5.9

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.4th

Official Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session could spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data. Apps are only affected if they have service workers registered and use the result of webContents.executeJavaScript() (or webFrameMain.executeJavaScript()) in security-sensitive decisions. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

NVD Source

Technical Analysis

CVE-2026-34778 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 5.9.