CVE-2026-113797
Description
A flaw was found in Electron. This vulnerability allows an untrusted extension loaded by an application to perform unauthorized information disclosure. When querying open tabs, the framework fails to verify whether the extension holds the required tab or host permissions. Consequently, a loaded extension can read the titles and web addresses (URLs) of all active browsing sessions without authorization.
Statement
This vulnerability is rated with a Low severity because exploitation requires an application to explicitly load untrusted third-party extensions into its session environment, and the disclosure is confined to tab metadata such as URLs and titles. In typical Red Hat deployments, Electron is not part of core server infrastructure and is utilized primarily within self-contained desktop applications or developer workstations. Applications that do not dynamically load untrusted extensions remain unaffected by this issue.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
