6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55305

CVE-2025-55305: Electron has ASAR Integrity Bypass via resource modification

Impact

This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted.

Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the resources folder in your app installation on Windows which these fuses are supposed to protect against.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

38.0.0-beta.6
37.3.1
36.8.1
35.7.5

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-55305

CVE-2025-55305:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
electron	npm	< 35.7.5	35.7.5
electron	npm	>= 36.0.0-alpha.1, < 36.8.1	36.8.1
electron	npm	>= 37.0.0-alpha.1, < 37.3.1	37.3.1
electron	npm	>= 38.0.0-alpha.1, < 38.0.0-beta.6	38.0.0-beta.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of integrity validation for the V8 snapshot when an Electron application is launched. This allows an attacker with local file system access to modify the snapshot and achieve arbitrary code execution. The analysis of the provided patches reveals two key functions that contribute to this vulnerability.

gin::GetMappedFileData: This function in gin/v8_initializer.cc is directly responsible for loading the V8 snapshot data. The patches show the addition of a call to SnapshotValidator().Run(data), which performs the integrity check. Before this change, the function would map the snapshot file into memory without any validation, making it the direct point of failure where a malicious snapshot would be processed.
ElectronMainDelegate::ElectronMainDelegate: This constructor in shell/app/electron_main_delegate.cc is the entry point for configuring the application's behavior. The patch modifies it from a default constructor to one that explicitly calls gin::SetV8SnapshotValidator. This new call registers the validation function that GetMappedFileData will use. The original default constructor lacked this setup, meaning the validation mechanism was never enabled, thus creating the security hole.

Both functions are critical to understanding the vulnerability. ElectronMainDelegate::ElectronMainDelegate is where the security measure should have been initiated, and gin::GetMappedFileData is where the unvalidated data was consumed. During exploitation, a profiler would show ElectronMainDelegate::ElectronMainDelegate being called during application startup, and gin::GetMappedFileData being called when the V8 engine is initialized and the snapshot is loaded.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.