What is GHSA-9w97-2464-8783?

GHSA-9w97-2464-8783 is a security advisory published by GitHub Security Advisories with Medium severity. Electron: Use-after-free in download save dialog callback

Which CVE IDs does GHSA-9w97-2464-8783 cover?

GHSA-9w97-2464-8783 covers the following CVE IDs: CVE-2026-34772. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9w97-2464-8783?

GHSA-9w97-2464-8783 has a CVSS v3 base score of 5.8, published by GitHub Security Advisories.

Which products are affected by GHSA-9w97-2464-8783?

GHSA-9w97-2464-8783 affects 4 products, including: npm/electron:\u003c 38.8.6; npm/electron:\u003e= 39.0.0-alpha.1, \u003c 39.8.0; npm/electron:\u003e= 40.0.0-alpha.1, \u003c 40.7.0; npm/electron:\u003e= 41.0.0-alpha.1, \u003c 41.0.0-beta.7.

GHSA-9w97-2464-8783MediumCVSS 5.8

Electron: Use-after-free in download save dialog callback

Vendor

GitHub Security Advisories

Published

April 3, 2026

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-34772 →

📋 Description

Impact

Apps that allow downloads and programmatically destroy sessions may be vulnerable to a use-after-free. If a session is torn down while a native save-file dialog is open for a download, dismissing the dialog dereferences freed memory, which may lead to a crash or memory corruption.

Apps that do not destroy sessions at runtime, or that do not permit downloads, are not affected.

Workarounds

Avoid destroying sessions while a download save dialog may be open. Cancel pending downloads before session teardown.

Fixed Versions

41.0.0-beta.7
40.7.0
39.8.0
38.8.6

For more information

If there are any questions or comments about this advisory, please email [email protected]

🎯 Affected products4

npm/electron:< 38.8.6
npm/electron:>= 39.0.0-alpha.1, < 39.8.0
npm/electron:>= 40.0.0-alpha.1, < 40.7.0
npm/electron:>= 41.0.0-alpha.1, < 41.0.0-beta.7