Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)
Severity: high · Patch status: patched · Since 2026-10-22 · CVE-2026-111943, CVE-2026-113470, CVE-2026-115557, CVE-2026-115570
A set of eMudhra intermediate CA certificates was compromised and is being blocked by browsers and other TLS clients. Electron releases before the patched versions did not block these intermediates in either Chromium networking or Node.js tls/https/fetch, so an attacker holding a certificate issued via the compromised intermediates and able to intercept network traffic (e.g. on-path/MitM) could impersonate a TLS server to an Electron app. Only apps making TLS network connections are affected; offline apps are not. Go (CVE-2026-111943) and Firefox (CVE-2026-113470) shipped the same mitigation. There are no app-side workarounds; fixed releases are 45.0.0-beta.6, 44.9.1, 43.8.1 and 42.11.16, published 2026-10-22/23.
What to do
- Upgrade Electron to 45.0.0-beta.6, 44.9.1, 43.8.1 or 42.11.16 (or later) and rebuild/redistribute apps, prioritising apps that make TLS connections over untrusted networks
- Audit which Electron apps in your estate make network connections and prioritise those handling sensitive data
- Verify no pinned or custom certificate logic bypasses the new block; confirm updated builds ship the mitigation in both Chromium and Node.js TLS paths
- Monitor for any further eMudhra-related revocations or advisories affecting other TLS clients in your stack
Fixed versions
- 45.0.0-beta.6
- 44.9.1
- 43.8.1
- 42.11.16
Sources
All live incidents on Threat Watch
