{
  "schema_version": 1,
  "app_id": "io.thepeoples.ChatGPT",
  "slug": "chatgpt",
  "version": "26.1103.60933",
  "scanned_at": "2026-11-10T22:16:27Z",
  "scanner": {
    "name": "trivy",
    "version": "0.73.0",
    "db_updated_at": "2026-11-10T01:02:55Z"
  },
  "input": {
    "kind": "deb",
    "filename": "chatgpt_26.1103.60933_amd64.deb",
    "sha256": "0746e9ba575182f5dbe32617b82a645eb93ad57ca588e5a9358695a6b65aee71",
    "extracted_without_scripts": true
  },
  "gate": {
    "result": "pass",
    "fail_on": "wrap CRITICAL"
  },
  "counts": {
    "wrap": {
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0,
      "unknown": 0
    },
    "vendor": {
      "critical": 0,
      "high": 25,
      "medium": 51,
      "low": 18,
      "unknown": 0
    }
  },
  "coverage": {
    "packages_seen": 101,
    "wrap": {
      "status": "inventoried",
      "packages_seen": 0,
      "notes": []
    },
    "vendor": {
      "status": "inventoried",
      "packages_seen": 101,
      "notes": [
        "electron asar",
        "package.json uses yarn workspace protocol",
        "electron 33.2.1 from package.json",
        "electron 35.2.0 from package.json",
        "skipped workspace protocol package.json deps",
        "read 115 package.json file(s)",
        "trivy sbom on 101 derived PURLs"
      ]
    }
  },
  "findings": [
    {
      "id": "CVE-2025-55305",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6",
      "class": "vendor",
      "title": "electron: ASAR Integrity Bypass via resource modification"
    },
    {
      "id": "CVE-2025-55305",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6",
      "class": "vendor",
      "title": "electron: ASAR Integrity Bypass via resource modification"
    },
    {
      "id": "CVE-2026-102672",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.10, 41.10.5, 42.0.0-beta.2",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary file overwrite via race condition in ShipIt update helper"
    },
    {
      "id": "CVE-2026-102672",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.10, 41.10.5, 42.0.0-beta.2",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary file overwrite via race condition in ShipIt update helper"
    },
    {
      "id": "CVE-2026-102673",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "41.10.4, 42.5.2, 43.0.0",
      "class": "vendor",
      "title": "electron: Electron: Sandbox bypass via popups opened from sandboxed iframes"
    },
    {
      "id": "CVE-2026-102673",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "41.10.4, 42.5.2, 43.0.0",
      "class": "vendor",
      "title": "electron: Electron: Sandbox bypass via popups opened from sandboxed iframes"
    },
    {
      "id": "CVE-2026-102674",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: Electron: Sandbox bypass via popup window creation"
    },
    {
      "id": "CVE-2026-102674",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: Electron: Sandbox bypass via popup window creation"
    },
    {
      "id": "CVE-2026-102675",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers"
    },
    {
      "id": "CVE-2026-102675",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers"
    },
    {
      "id": "CVE-2026-102676",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: electron: Privilege escalation via unauthorized Node.js integration in web workers"
    },
    {
      "id": "CVE-2026-102676",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5",
      "class": "vendor",
      "title": "electron: electron: Privilege escalation via unauthorized Node.js integration in web workers"
    },
    {
      "id": "CVE-2026-113796",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "45.0.0-alpha.6, 44.3.0, 43.7.0, 42.11.3",
      "class": "vendor",
      "title": "electron: electron: SameSite cookie bypass via incorrect navigation initiator handling"
    },
    {
      "id": "CVE-2026-113796",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "45.0.0-alpha.6, 44.3.0, 43.7.0, 42.11.3",
      "class": "vendor",
      "title": "electron: electron: SameSite cookie bypass via incorrect navigation initiator handling"
    },
    {
      "id": "CVE-2026-113797",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "45.0.0-alpha.4, 44.1.1, 43.5.1, 42.11.1",
      "class": "vendor",
      "title": "electron: Electron: Information disclosure via improper permission validation in tab queries"
    },
    {
      "id": "CVE-2026-113797",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "45.0.0-alpha.4, 44.1.1, 43.5.1, 42.11.1",
      "class": "vendor",
      "title": "electron: Electron: Information disclosure via improper permission validation in tab queries"
    },
    {
      "id": "CVE-2026-113798",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "45.0.0-alpha.13, 44.5.0, 43.7.6, 42.11.9",
      "class": "vendor",
      "title": "electron: Electron: Unauthorized pointer lock permission grant via cross-origin iframes"
    },
    {
      "id": "CVE-2026-113798",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "45.0.0-alpha.13, 44.5.0, 43.7.6, 42.11.9",
      "class": "vendor",
      "title": "electron: Electron: Unauthorized pointer lock permission grant via cross-origin iframes"
    },
    {
      "id": "CVE-2026-113800",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "45.0.0-alpha.5, 44.3.0, 43.7.0, 42.11.3",
      "class": "vendor",
      "title": "electron: electron: Unauthorized device access via incorrect frame origin validation"
    },
    {
      "id": "CVE-2026-113800",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "45.0.0-alpha.5, 44.3.0, 43.7.0, 42.11.3",
      "class": "vendor",
      "title": "electron: electron: Unauthorized device access via incorrect frame origin validation"
    },
    {
      "id": "CVE-2026-114121",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5",
      "class": "vendor",
      "title": "electron: Electron: Unauthorized application launch via external protocol URL misattribution"
    },
    {
      "id": "CVE-2026-114121",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5",
      "class": "vendor",
      "title": "electron: Electron: Unauthorized application launch via external protocol URL misattribution"
    },
    {
      "id": "CVE-2026-114122",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9",
      "class": "vendor",
      "title": "electron: Electron: Information disclosure via inconsistent GPU frame geometry"
    },
    {
      "id": "CVE-2026-114122",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9",
      "class": "vendor",
      "title": "electron: Electron: Information disclosure via inconsistent GPU frame geometry"
    },
    {
      "id": "CVE-2026-114124",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9",
      "class": "vendor",
      "title": "electron: electron: Information disclosure via inconsistent GPU frame geometry"
    },
    {
      "id": "CVE-2026-114124",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "42.11.6, 43.7.3, 44.4.3, 45.0.0-alpha.9",
      "class": "vendor",
      "title": "electron: electron: Information disclosure via inconsistent GPU frame geometry"
    },
    {
      "id": "CVE-2026-115570",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "45.0.0-beta.6, 44.9.1, 43.8.1, 42.11.16",
      "class": "vendor",
      "title": "electron: Electron: TLS server impersonation via compromised intermediate certificates"
    },
    {
      "id": "CVE-2026-115570",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "45.0.0-beta.6, 44.9.1, 43.8.1, 42.11.16",
      "class": "vendor",
      "title": "electron: Electron: TLS server impersonation via compromised intermediate certificates"
    },
    {
      "id": "CVE-2026-33671",
      "severity": "HIGH",
      "pkg": "picomatch",
      "installed": "4.0.3",
      "fixed": "4.0.4, 3.0.2, 2.3.2",
      "class": "vendor",
      "title": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns"
    },
    {
      "id": "CVE-2026-33672",
      "severity": "MEDIUM",
      "pkg": "picomatch",
      "installed": "4.0.3",
      "fixed": "4.0.4, 3.0.2, 2.3.2",
      "class": "vendor",
      "title": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions"
    },
    {
      "id": "CVE-2026-34764",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "Electron: Electron: Memory corruption or crash due to use-after-free in offscreen rendering with shared textures."
    },
    {
      "id": "CVE-2026-34764",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "Electron: Electron: Memory corruption or crash due to use-after-free in offscreen rendering with shared textures."
    },
    {
      "id": "CVE-2026-34765",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary code execution or information disclosure via incorrect window handling"
    },
    {
      "id": "CVE-2026-34765",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary code execution or information disclosure via incorrect window handling"
    },
    {
      "id": "CVE-2026-34766",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Electron: Unauthorized USB device access via select-usb-device event callback validation bypass"
    },
    {
      "id": "CVE-2026-34766",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Electron: Unauthorized USB device access via select-usb-device event callback validation bypass"
    },
    {
      "id": "CVE-2026-34767",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.3, 40.8.3, 41.0.3",
      "class": "vendor",
      "title": "electron: Electron: HTTP Response Header Injection via attacker-controlled input"
    },
    {
      "id": "CVE-2026-34767",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.3, 40.8.3, 41.0.3",
      "class": "vendor",
      "title": "electron: Electron: HTTP Response Header Injection via attacker-controlled input"
    },
    {
      "id": "CVE-2026-34768",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary code execution via unquoted path in Run registry key"
    },
    {
      "id": "CVE-2026-34768",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "electron: Electron: Arbitrary code execution via unquoted path in Run registry key"
    },
    {
      "id": "CVE-2026-34769",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Electron: Arbitrary code execution and security bypass via undocumented command-line switches"
    },
    {
      "id": "CVE-2026-34769",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Electron: Arbitrary code execution and security bypass via undocumented command-line switches"
    },
    {
      "id": "CVE-2026-34770",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Use-after-free in PowerMonitor on Windows and macOS"
    },
    {
      "id": "CVE-2026-34770",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: Use-after-free in PowerMonitor on Windows and macOS"
    },
    {
      "id": "CVE-2026-34771",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "electron: Electron: Memory corruption or application crash via use-after-free in permission request handling"
    },
    {
      "id": "CVE-2026-34771",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "electron: Electron: Memory corruption or application crash via use-after-free in permission request handling"
    },
    {
      "id": "CVE-2026-34772",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7",
      "class": "vendor",
      "title": "Electron: Electron: Use-after-free vulnerability leads to memory corruption or crash"
    },
    {
      "id": "CVE-2026-34772",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7",
      "class": "vendor",
      "title": "Electron: Electron: Use-after-free vulnerability leads to memory corruption or crash"
    },
    {
      "id": "CVE-2026-34773",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "electron: Electron: Protocol handler hijacking via improper validation of protocol names"
    },
    {
      "id": "CVE-2026-34773",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "electron: Electron: Protocol handler hijacking via improper validation of protocol names"
    },
    {
      "id": "CVE-2026-34774",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.1, 40.7.0, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Memory corruption and crash due to use-after-free in offscreen rendering"
    },
    {
      "id": "CVE-2026-34774",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.1, 40.7.0, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Memory corruption and crash due to use-after-free in offscreen rendering"
    },
    {
      "id": "CVE-2026-34775",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.4, 40.8.4, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Arbitrary code execution and information disclosure due to incorrect Node.js integration scoping"
    },
    {
      "id": "CVE-2026-34775",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.4, 40.8.4, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Arbitrary code execution and information disclosure due to incorrect Node.js integration scoping"
    },
    {
      "id": "CVE-2026-34776",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Information disclosure via crafted second-instance message"
    },
    {
      "id": "CVE-2026-34776",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Information disclosure via crafted second-instance message"
    },
    {
      "id": "CVE-2026-34777",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Unauthorized permission granting and information disclosure via incorrect iframe origin"
    },
    {
      "id": "CVE-2026-34777",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Unauthorized permission granting and information disclosure via incorrect iframe origin"
    },
    {
      "id": "CVE-2026-34778",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Integrity issue due to IPC channel spoofing by a service worker"
    },
    {
      "id": "CVE-2026-34778",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.1, 40.8.1, 41.0.0",
      "class": "vendor",
      "title": "Electron: Electron: Integrity issue due to IPC channel spoofing by a service worker"
    },
    {
      "id": "CVE-2026-34779",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: AppleScript injection in app.moveToApplicationsFolder on macOS"
    },
    {
      "id": "CVE-2026-34779",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8",
      "class": "vendor",
      "title": "Electron: AppleScript injection in app.moveToApplicationsFolder on macOS"
    },
    {
      "id": "CVE-2026-34781",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "Electron: Electron: Denial of Service via malformed clipboard image data"
    },
    {
      "id": "CVE-2026-34781",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5",
      "class": "vendor",
      "title": "Electron: Electron: Denial of Service via malformed clipboard image data"
    },
    {
      "id": "CVE-2026-70597",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Parent process code-sign check is spoofable"
    },
    {
      "id": "CVE-2026-70597",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Parent process code-sign check is spoofable"
    },
    {
      "id": "CVE-2026-70598",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size"
    },
    {
      "id": "CVE-2026-70598",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.10, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size"
    },
    {
      "id": "CVE-2026-70599",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin"
    },
    {
      "id": "CVE-2026-70599",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin"
    },
    {
      "id": "CVE-2026-70600",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Cross-origin iframe can position native autofill popup"
    },
    {
      "id": "CVE-2026-70600",
      "severity": "LOW",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Cross-origin iframe can position native autofill popup"
    },
    {
      "id": "CVE-2026-70601",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5",
      "class": "vendor",
      "title": "Electron: Context isolation bypass via Function.prototype.bind hijack"
    },
    {
      "id": "CVE-2026-70601",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5",
      "class": "vendor",
      "title": "Electron: Context isolation bypass via Function.prototype.bind hijack"
    },
    {
      "id": "CVE-2026-70602",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Extension tab APIs operate across session boundaries"
    },
    {
      "id": "CVE-2026-70602",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Extension tab APIs operate across session boundaries"
    },
    {
      "id": "CVE-2026-70603",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "42.0.0-beta.1, 41.1.1, 40.9.0, 39.8.6",
      "class": "vendor",
      "title": "Electron: shell.openPath path validation bypass via embedded null byte"
    },
    {
      "id": "CVE-2026-70603",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "42.0.0-beta.1, 41.1.1, 40.9.0, 39.8.6",
      "class": "vendor",
      "title": "Electron: shell.openPath path validation bypass via embedded null byte"
    },
    {
      "id": "CVE-2026-70604",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "42.0.0, 41.4.0, 40.9.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads"
    },
    {
      "id": "CVE-2026-70604",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "42.0.0, 41.4.0, 40.9.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads"
    },
    {
      "id": "CVE-2026-70605",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: HTTP redirect followed into local file loader"
    },
    {
      "id": "CVE-2026-70605",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: HTTP redirect followed into local file loader"
    },
    {
      "id": "CVE-2026-70607",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: window.open features string controls some window options considered privileged"
    },
    {
      "id": "CVE-2026-70607",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: window.open features string controls some window options considered privileged"
    },
    {
      "id": "CVE-2026-70608",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "42.0.1, 41.10.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path"
    },
    {
      "id": "CVE-2026-70608",
      "severity": "HIGH",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "42.0.1, 41.10.3, 39.8.10",
      "class": "vendor",
      "title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path"
    },
    {
      "id": "CVE-2026-70609",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
    },
    {
      "id": "CVE-2026-70609",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1",
      "class": "vendor",
      "title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
    },
    {
      "id": "CVE-2026-70610",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4",
      "class": "vendor",
      "title": "Electron: contextBridge object copy honors prototype setters"
    },
    {
      "id": "CVE-2026-70610",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4",
      "class": "vendor",
      "title": "Electron: contextBridge object copy honors prototype setters"
    },
    {
      "id": "CVE-2026-70611",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: DevTools embedder handler executes arbitrary files via shell open"
    },
    {
      "id": "CVE-2026-70611",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: DevTools embedder handler executes arbitrary files via shell open"
    },
    {
      "id": "CVE-2026-70612",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "33.2.1",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Sandboxed iframes can launch external protocol handlers"
    },
    {
      "id": "CVE-2026-70612",
      "severity": "MEDIUM",
      "pkg": "electron",
      "installed": "35.2.0",
      "fixed": "39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3",
      "class": "vendor",
      "title": "Electron: Sandboxed iframes can launch external protocol handlers"
    }
  ]
}