GHSA-jr5w-w6x2-84p9

Electron: Mitigation for compromised eMudhra intermediate certificates

### Impact A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients. This Electron update adds the same block to both Chromium networking and Node.js `tls`, `https` and `fetch`. On earlier versions, an attacker holding a certificate issued through these intermediates and able to intercept network traffic could impersonate a TLS server to an app. Apps are only affected if they make TLS connections over a network an attacker can intercept. Apps that make no network connections are not affected. Other software has shipped the same mitigation, including Go (CVE-2026-111943) and Firefox (CVE-2026-113470). ### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ### Fixed Versions * `45.0.0-beta.6` * `44.9.1` * `43.8.1` * `42.11.16` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)