Vendor
electron
Tracked since 30 Sep · latest article 30 Sep · RSS · API
None open
of 0 in the full CISA catalogue · all time
EPSS top 5%, not in KEV
none this week
Exploited, by due date
No electron CVE is in the CISA KEV catalogue.
Patch cadence and exploit odds
How often CISA adds electron CVEs, how many have a fix, and where their exploit odds sit.
Added to CISA KEV per quarter
CISA has not added a electron CVE to KEV.
Fix listed
0 of 5 CVEs in coverage
5 CVEs have no vendor fix recorded yet.
EPSS percentile of each CVE
One dot per CVE; a red diamond marks those in CISA KEV.
Show as tableHide table
| CVE | EPSS percentile |
|---|---|
| CVE-2026-102676 | 41.9 |
| CVE-2026-102674 | 14.7 |
| CVE-2026-102675 | 11.9 |
| CVE-2026-102673 | 2.8 |
| CVE-2026-102677 | 0.8 |
Coverage1 article · all time
The latest article naming electron, in the shared story grammar.
1 article from 1 outlet since 30 Sep. Quiet since 30 Sep.
- Wed 30 Sep, 06:01 UTC. SecurityOnline, first report. Five Electron Flaws Let Untrusted Content Escape App Protections.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 1 articles as a listHide the list
- Wed 30 SepDay 01
- Five Electron Flaws Let Untrusted Content Escape App Protections06:01 · SecurityOnline · First report
All CVEs in coverage5
Exploited first, then by EPSS
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
8.3High0.5% EPSS · 1 articleElectron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
8.2High0.2% EPSS · 1 articleElectron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
7.4High0.2% EPSS · 1 articleElectron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
8.2High0.1% EPSS · 1 articleElectron: Sandboxed preload code cache can be poisoned by a compromised renderer
7.8High0.1% EPSS · 1 article