CVE-2026-102677

[CVE catalog]

Severity

High · CVSS 7.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Published

Sep 29, 2026, 5:43:26 PM UTC

Updated

Sep 29, 2026, 6:17:09 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.10% · Oct 25, 2026

A flaw was found in Electron. The cache mechanism for sandboxed preload scripts fails to verify that cached entries match the requested script. In applications that load untrusted web content, an attacker with a compromised renderer process can write malicious data into the cache to be reused on subsequent loads. This allows the attacker to achieve privilege escalation and execute arbitrary code within the higher-privileged preload execution context. electron: Electron: Privilege escalation via sandboxed preload code cache poisoning A flaw was found in Electron's sandboxed preload code cache mechanism. When applications load untrusted content, a compromised renderer process can write unverified cache entries that are subsequently loaded during future script executions. This allows a local attacker to execute arbitrary code within the higher-privileged preload execution context, bypassing sandbox isolation boundaries. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.