Electron's cache for sandboxed preload scripts did not verify that a cached entry corresponded to the preload script it was served for. This flaw allows a compromised renderer process to inject its own code into the preload context by poisoning the cache, leading to potential code execution in that context on later loads. The vulnerability affects Electron versions >=42.3.3 <42.10.0, >=43.0.0-beta.1 <43.5.0, and >=44.0.0-alpha.1 <44.0.0-beta.6. Applications that do not load untrusted content are not affected. The issue is tracked as CVE-2026-102677 and has a CVSS 3.1 score of 7.8 (high severity).

A compromised renderer process can execute arbitrary code in the preload context by poisoning the sandboxed preload script cache. This can lead to complete compromise of the preload environment, affecting confidentiality, integrity, and availability of the application. The impact is high but limited to applications that load untrusted content.

Update Electron to one of the fixed versions: 42.10.0 or later in the 42.x line, 43.5.0 or later in the 43.x line, or 44.0.0-beta.6 or later in the 44.x line. There are no application-side workarounds; patching Electron is required to remediate this vulnerability.