CyberRota Analysis
AI-GeneratedThe vulnerability affects Electron applications using JavaScript, HTML, and CSS, where the main process fails to fully validate offscreen rendering frame data from the GPU process. This could allow a compromised GPU process to exploit out-of-bounds memory access, potentially leading to information disclosure or application crashes. Developers and organizations utilizing affected versions of Electron should prioritize updating to the fixed releases to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app. This issue is fixed in 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3.