Electron published an advisory for CVE-2026-115570 on October 22, 2026, requiring runtime updates to block compromised eMudhra intermediate certificates. GitHub published, reviewed and updated its database record on October 23, 2026. Sources: Electron, GitHub Advisory Database
Electron versions below 42.11.16 are fixed in 42.11.16. Versions from 43.0.0-alpha.1 to below 43.8.1 are fixed in 43.8.1. Versions from 44.0.0-alpha.1 to below 44.9.1 are fixed in 44.9.1. Versions from 45.0.0-alpha.1 to below 45.0.0-beta.6 are fixed in 45.0.0-beta.6, a beta release. Sources: Electron
The certificate mitigation covers Chromium networking and Node.js networking APIs, including tls, https and fetch. Exposure involves applications making TLS connections over networks an attacker can intercept. The attacker must also possess a certificate issued through the compromised intermediates. Applications making no network connections are unaffected; the advisory does not establish exploitation of individual applications. Sources: Electron, GitHub Advisory Database
Electron says there is no application-side workaround. Configuration changes cannot replace the runtime update. Sources: Electron
What to do
The advisory requires updating Electron. BuildRiot recommends these rollout steps, including rebuilding and redistribution where applicable: Sources: Electron
- Inventory shipped Electron runtimes using the affected ranges above to identify applications needing the appropriate patched release.
- Rebuild affected applications with the appropriate patched release where applicable.
- Distribute the updated applications where applicable.
- Verify that installed applications use the appropriate patched release.