---
id: CVE-2026-113797
title: >-
  Electron: Extension tabs.query returns tab URLs and titles without the tabs
  permission
summary: >-
  Electron is a framework for writing cross-platform desktop applications using
  JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and
  45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to
  extensions th…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: electron
product: electron
affected:
  - electron < 42.11.1
  - 'electron >= 43.0.0-alpha.1, < 43.5.1'
  - 'electron >= 44.0.0-alpha.1, < 44.1.1'
  - 'electron >= 45.0.0-alpha.1, < 45.0.0-alpha.4'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T16:09:00.242Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113797'
references:
  - url: >-
      https://github.com/electron/electron/security/advisories/GHSA-98mx-cjp9-gchm
    label: >-
      https://github.com/electron/electron/security/advisories/GHSA-98mx-cjp9-gchm
  - url: 'https://github.com/electron/electron/pull/52597'
    label: 'https://github.com/electron/electron/pull/52597'
  - url: 'https://github.com/electron/electron/pull/53353'
    label: 'https://github.com/electron/electron/pull/53353'
  - url: 'https://github.com/electron/electron/pull/53354'
    label: 'https://github.com/electron/electron/pull/53354'
  - url: 'https://github.com/electron/electron/pull/53355'
    label: 'https://github.com/electron/electron/pull/53355'
  - url: 'https://github.com/electron/electron/pull/53356'
    label: 'https://github.com/electron/electron/pull/53356'
  - url: >-
      https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4
    label: >-
      https://github.com/electron/electron/commit/16e6103c1d84cd1c46336647b55e96414da501a4
  - url: >-
      https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c
    label: >-
      https://github.com/electron/electron/commit/5acc76667d32ff310d04f965b47983412ab6553c
  - url: >-
      https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f
    label: >-
      https://github.com/electron/electron/commit/b1eb86ca8f6fa39fe9d5fee21bb9a0bf591a6a3f
  - url: >-
      https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921
    label: >-
      https://github.com/electron/electron/commit/d6529d65e5f096cd45bbb2828febb2c6baa53921
  - url: >-
      https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f
    label: >-
      https://github.com/electron/electron/commit/f3ae30fab9aabfd445eedff4dd7a2f003eb1ff2f
  - url: 'https://github.com/electron/electron/releases/tag/v42.11.1'
    label: 'https://github.com/electron/electron/releases/tag/v42.11.1'
  - url: 'https://github.com/electron/electron/releases/tag/v43.5.1'
    label: 'https://github.com/electron/electron/releases/tag/v43.5.1'
  - url: 'https://github.com/electron/electron/releases/tag/v44.1.1'
    label: 'https://github.com/electron/electron/releases/tag/v44.1.1'
  - url: 'https://github.com/electron/electron/releases/tag/v45.0.0-alpha.4'
    label: 'https://github.com/electron/electron/releases/tag/v45.0.0-alpha.4'
tags:
  - cve.org
ingestedAt: '2026-10-21T17:07:51.312Z'
---

## Overview

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that had neither the tabs permission nor matching host permissions. An application that loaded an extension it did not fully trust through session.extensions.loadExtension could therefore allow that extension to read the URL and title of every webContents in its session. This issue is fixed in versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4.

## Affected

- `electron < 42.11.1`
- `electron >= 43.0.0-alpha.1, < 43.5.1`
- `electron >= 44.0.0-alpha.1, < 44.1.1`
- `electron >= 45.0.0-alpha.1, < 45.0.0-alpha.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.