Is CVE-2026-34780 actively exploited?

No active exploitation of CVE-2026-34780 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34780 be exploited remotely?

Yes. CVE-2026-34780 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34780?

CVE-2026-34780 has a CVSS score of 8.3 (HIGH).

HOME VULNERABILITIESCVE-2026-34780

HIGH

CVE-2026-34780

CWE-668Published: April 4, 2026· Updated: Apr 7, 2026

8.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.7th

Official Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8, apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable to a context isolation bypass. An attacker who can execute JavaScript in the main world (for example, via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script. Apps are only affected if a preload script returns, resolves, or passes a VideoFrame object to the main world via contextBridge.exposeInMainWorld(). Apps that do not bridge VideoFrame objects are not affected. This issue has been patched in versions 39.8.0, 40.7.0, and 41.0.0-beta.8.

NVD Source

Technical Analysis

CVE-2026-34780 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.3.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.