CVE-2026-102677

electronjs electron

score 15HIGH 7.8

Summary

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.

Published 2026-09-29 · first seen here 2026-10-10

Analysis & write-ups

No technical write-up from a research team yet. Contact Zero checks Unit 42, Google/Mandiant, Microsoft, Talos, CrowdStrike, Rapid7, watchTowr and others several times a day, plus NVD and CISA reference links.

Where it shows in your logs

Server or web application · Authentication bypass or missing authorisation medium confidence

What to look for

Admin or API actions with no successful login before them in the same session
New admin accounts, API keys or tokens created shortly after unusual requests
Requests to admin or API endpoints from internet IPs
The application's process (w3wp.exe, java, tomcat, node, php-fpm, httpd, python) starting shells or LOLBins (cmd, powershell, sh, bash, curl, wget, certutil)
New script files in web roots (.jsp, .aspx, .php): a web shell
Requests to unusual URLs on the application from internet IPs right before any of the above
Outbound connections from the server to new external IPs

Data sources

Web server and WAF logs · ATT&CK DS0015 Application Log Content

Sentinel: W3CIISLogAppServiceHTTPLogsAzureDiagnostics (Application Gateway / Front Door WAF)_Im_WebSession
Splunk: Web.Webms:iis:autoaccess_combinedWAF / proxy sourcetypes
CrowdStrike: Falcon Next-Gen SIEM: third-party web / WAF / proxy logs

Process creation · ATT&CK DS0009 Process Creation

Sentinel: DeviceProcessEventsSecurityEvent (4688)Sysmon Event ID 1_Im_ProcessCreate
Splunk: Endpoint.ProcessesXmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Security (4688)
CrowdStrike: ProcessRollup2SyntheticProcessRollup2

File creation · ATT&CK DS0022 File Creation

Sentinel: DeviceFileEventsSysmon Event ID 11_Im_FileEvent
Splunk: Endpoint.FilesystemSysmon Event ID 11
CrowdStrike: NewExecutableWrittenNewScriptWritten*FileWritten events

Network connections · ATT&CK DS0029 Network Connection Creation / Network Traffic Flow

Sentinel: DeviceNetworkEventsCommonSecurityLog (firewall)_Im_NetworkSession
Splunk: Network_Traffic.All_TrafficFirewall sourcetypes (pan:traffic, fortigate_traffic, cisco:asa)
CrowdStrike: NetworkConnectIP4NetworkReceiveAcceptIP4NetworkConnectIP6

Authentication and sessions · ATT&CK DS0028 Logon Session Creation / DS0002 User Account Authentication

Sentinel: SigninLogsSecurityEvent (4624, 4625, 4648)DeviceLogonEventsIdentityLogonEvents_Im_Authentication
Splunk: Authentication.Authenticationpan:globalprotectVPN sourcetypes
CrowdStrike: UserLogonUserLogonFailed2Falcon Identity Protection events

Account and group changes · ATT&CK DS0002 User Account Creation / Modification

Sentinel: SecurityEvent (4720, 4728, 4732, 4756)AuditLogsIdentityDirectoryEvents
Splunk: Change.All_Changes (Account_Management)WinEventLog:Security (4720, 4732)
CrowdStrike: UserAccountCreatedUserAccountAddedToGroup