Electron PowerMonitor Use-After-Free Vulnerability on Windows and macOS

A use-after-free vulnerability has been identified in Electron applications that use the powerMonitor module, prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8. When the native PowerMonitor object is garbage-collected, it leaves behind dangling references to OS-level resources, such as a message window on Windows or a shutdown handler on macOS. This can lead to memory corruption or crashes when these resources are accessed after the memory has been freed. All apps that interact with powerMonitor events, like suspend or resume, may be affected.

Impact

Exploitation of this vulnerability can cause crashes or memory corruption in affected applications.

Remediation

Users must update to Electron versions 38.8.6, 39.8.1, 40.8.0, or 41.0.0-beta.8 to address this vulnerability.