Zero Radar
← feed
CriticalVulnerabilityCVE-2026-115570updated 25 Oct 2026, 15:20 UTC

Electron apps can accept fake secure websites due to compromised certificates

Some digital certificates used to prove a website is genuine were compromised. Attackers holding them could pose as a trusted server to apps built with Electron if they can intercept network traffic.

Attacks reported (Cisco PSIRT)Fix availableOfficial, 5 sources
SeverityCriticalCVSS 7.4 of 10
Being exploited?ReportedBy Cisco PSIRT, not officially confirmed yet
Fix available?Yes45.0.0-beta.6, 44.9.1, 43.8.1, 42.11.16 · since 25 Oct 2026
How sure is this?Official, 5 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker obtains certificateHolds a cert from compromised eMudhra intermediate
  2. 2Intercepts trafficSits on a network the app connects over
  3. 3Impersonates serverPresents the forged certificate during TLS
  4. 4Electron app trusts itUnpatched Electron does not block the certificate
  5. 5Data exposedTraffic read or altered by attacker
  6. ResultAttacker impersonates a trusted server to the app

What happened

Electron does not block eMudhra intermediate certificates that were compromised, in Chromium networking and Node.js tls, https and fetch. An attacker with such a certificate who can intercept traffic can impersonate a TLS server to an affected app.

Why it is dangerous: Attackers on the network path could intercept or alter data an app receives over HTTPS, such as logins or updates. Desktop apps built on Electron that connect over networks an attacker can intercept are at risk.

Are you affected?

You are affected if you ship or run an Electron app on a vulnerable version and it makes TLS connections over a network an attacker could intercept.

Package / productAffected versionsFixed in
electron · npm>= 45.0.0-alpha.1, < 45.0.0-beta.645.0.0-beta.6
electron · npm>= 44.0.0-alpha.1, < 44.9.144.9.1
electron · npm>= 43.0.0-alpha.1, < 43.8.143.8.1
electron · npm< 42.11.1642.11.16

What to do

  1. Update Electron to 44.9.1, 43.8.1, 42.11.16 or 45.0.0-beta.6 (whichever matches your release line)
  2. Rebuild and redistribute your Electron app so end users receive the patched runtime
  3. Apps cannot work around this in code; the Electron update is required

Timeline

  1. 20 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 20 Oct 2026, 00:00 UTC
    Reported by Debian DSA · Debian DSA
  3. 20 Oct 2026, 00:00 UTC
    Reported by Rust Blog · Rust Blog
  4. 21 Oct 2026, 00:00 UTC
    Reported by Debian DSA · Debian DSA
  5. 23 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  6. 23 Oct 2026, 20:53 UTC
    Reported by GitHub Advisory · GitHub Advisory
  7. 25 Oct 2026, 15:20 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  8. 25 Oct 2026, 15:20 UTC
    Severity raised to critical

Sources 6 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115570 · GHSA-jr5w-w6x2-84p9 · ZR-65538afb
CVSS
7.4 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Electron apps can accept fake secure websites due to compromised certificates · Zero Radar