Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size (CVE-2026-70598)
CVE-2026-70598 is a low-severity vulnerability in Electron affecting applications that use offscreen rendering mode. The main process does not fully validate frame data received from the GPU process, allowing a compromised GPU process to cause out-of-bounds memory reads. This can lead to memory disclosure or application crashes. Only apps using offscreen rendering (webPreferences.offscreen) and with attacker control over the GPU process are affected. Fixed versions are 39.8.10 and later.
AI Analysis
Technical Summary
In Electron, when offscreen rendering is enabled, the main process trusts GPU-supplied geometry data without full validation. A compromised GPU process can exploit this to cause the main process to read out-of-bounds memory during paint event image generation. This results in potential memory disclosure or application crashes. The vulnerability requires prior code execution in the GPU process and affects only apps using offscreen rendering. The issue is tracked as CVE-2026-70598 and is classified as CWE-125 (Out-of-bounds Read).
Potential Impact
The vulnerability can lead to information disclosure of memory contents or application crashes due to out-of-bounds reads in the main process. However, exploitation requires that an attacker already has code execution in the GPU process and that the application uses offscreen rendering mode. Applications not using offscreen rendering are not affected.
Mitigation Recommendations
A patch is available and should be applied. Fixed Electron versions include 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3. There are no application-side workarounds; updating to a patched Electron version is required to mitigate this vulnerability.
Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size (CVE-2026-70598)
Description
CVE-2026-70598 is a low-severity vulnerability in Electron affecting applications that use offscreen rendering mode. The main process does not fully validate frame data received from the GPU process, allowing a compromised GPU process to cause out-of-bounds memory reads. This can lead to memory disclosure or application crashes. Only apps using offscreen rendering (webPreferences.offscreen) and with attacker control over the GPU process are affected. Fixed versions are 39.8.10 and later.
CVSS v3.1
Score 3.9low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Electron, when offscreen rendering is enabled, the main process trusts GPU-supplied geometry data without full validation. A compromised GPU process can exploit this to cause the main process to read out-of-bounds memory during paint event image generation. This results in potential memory disclosure or application crashes. The vulnerability requires prior code execution in the GPU process and affects only apps using offscreen rendering. The issue is tracked as CVE-2026-70598 and is classified as CWE-125 (Out-of-bounds Read).
Potential Impact
The vulnerability can lead to information disclosure of memory contents or application crashes due to out-of-bounds reads in the main process. However, exploitation requires that an attacker already has code execution in the GPU process and that the application uses offscreen rendering mode. Applications not using offscreen rendering are not affected.
Mitigation Recommendations
A patch is available and should be applied. Fixed Electron versions include 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3. There are no application-side workarounds; updating to a patched Electron version is required to mitigate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pfmc-3mgc-p6fp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70598"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a73852fbf8831d5394f061b
Added to database: 08/05/2026, 18:47:11 UTC
Last enriched: 08/05/2026, 21:33:29 UTC
Last updated: 08/06/2026, 01:59:00 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.