--- title: "CVE-2026-115570: Electron - Man-in-the-Middle" description: "Electron < 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6 contains a TLS impersonation vulnerability caused by failure to block compromised eMudhra intermediate certificates in Chromium networking and Node.js components, letting attackers intercept and impersonate TLS servers, exploit requires attacker to hold a certificate issued by compromised intermediates and intercept network traffic." url: https://panop.io/threat-heartbeat/CVE-2026-115570/ --- # CVE-2026-115570 Electron - Man-in-the-Middle Electron < 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6 contains a TLS impersonation vulnerability caused by failure to block compromised eMudhra intermediate certificates in Chromium networking and Node.js components, letting attackers intercept and impersonate TLS servers, exploit requires attacker to hold a certificate issued by compromised intermediates and intercept network traffic. CVSS base score 7.4 /10 High CISA KEV Not listed Public exploit None known EPSS 0.48% chance of exploitation in 30 days [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-115570) ## Details Type Man-in-the-Middle Impact Man In The Middle, Information Disclosure CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Published 23 October 2026 Updated 25 October 2026 Weakness [CWE-299](https://cwe.mitre.org/data/definitions/299.html) ## Vendor fix Update to versions 42.11.16, 43.8.1, 44.9.1, 45.0.0-beta.6 or later. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-115570](https://nvd.nist.gov/vuln/detail/CVE-2026-115570) - [https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad](https://github.com/electron/electron/commit/1d2f13b1985444a38abf389db38228ac42f5bcad) - [https://github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e7ad20](https://github.com/electron/electron/commit/817c43f925677eb88034bfba4f0b8dfd28e7ad20) - [https://github.com/electron/electron/pull/55128](https://github.com/electron/electron/pull/55128) - [https://github.com/electron/electron/pull/55129](https://github.com/electron/electron/pull/55129) - [https://github.com/electron/electron/releases/tag/v42.11.16](https://github.com/electron/electron/releases/tag/v42.11.16) - [https://github.com/electron/electron/releases/tag/v45.0.0-beta.6](https://github.com/electron/electron/releases/tag/v45.0.0-beta.6) - [https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc](https://github.com/electron/electron/commit/093583c71be71c85453e6e225137bf2af755fbcc) - [https://github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e800499](https://github.com/electron/electron/commit/e02265be96c5e13ae43644ef482b718e1e800499) - [https://github.com/electron/electron/pull/55127](https://github.com/electron/electron/pull/55127) - [https://github.com/electron/electron/pull/55130](https://github.com/electron/electron/pull/55130) - [https://github.com/electron/electron/releases/tag/v43.8.1](https://github.com/electron/electron/releases/tag/v43.8.1) - [https://github.com/electron/electron/releases/tag/v44.9.1](https://github.com/electron/electron/releases/tag/v44.9.1) - [https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9](https://github.com/electron/electron/security/advisories/GHSA-jr5w-w6x2-84p9) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)