# Electronjs Electron


- [CVE-2017-16151](https://insights.sbomify.com/CVE-2017-16151/): Chromium Remote Code Execution in electron (critical 9.8)
- [CVE-2018-1000118](https://insights.sbomify.com/CVE-2018-1000118/): Electron protocol handler browser vulnerable to Command Injection (high 8.8)
- [CVE-2026-34780](https://insights.sbomify.com/CVE-2026-34780/): Electron: Context Isolation bypass via contextBridge VideoFrame transfer (high 8.4)
- [CVE-2026-102676](https://insights.sbomify.com/CVE-2026-102676/): Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions (high 8.3)
- [CVE-2026-102673](https://insights.sbomify.com/CVE-2026-102673/): Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab (high 8.2)
- [CVE-2026-102674](https://insights.sbomify.com/CVE-2026-102674/): Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions (high 8.2)
- [CVE-2026-34774](https://insights.sbomify.com/CVE-2026-34774/): Electron: Use-after-free in offscreen child window paint callback (high 8.1)
- [CVE-2018-15685](https://insights.sbomify.com/CVE-2018-15685/): Electron webPreferences vulnerability can be used to perform remote code execution (high 8.1)
- [CVE-2018-1000136](https://insights.sbomify.com/CVE-2018-1000136/): Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration (high 8.1)
- [CVE-2026-102677](https://insights.sbomify.com/CVE-2026-102677/): Electron: Sandboxed preload code cache can be poisoned by a compromised renderer (high 7.8)
- [CVE-2026-34769](https://insights.sbomify.com/CVE-2026-34769/): Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference (high 7.8)
- [CVE-2020-4076](https://insights.sbomify.com/CVE-2020-4076/): Context isolation bypass via leaked cross-context objects in Electron (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/products/electronjs/electron/