Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
123 vulnerabilities found for electron by electron
CVE-2026-102677 (GCVE-0-2026-102677)
Vulnerability from nvd – Published: 2026-09-29 17:43 – Updated: 2026-09-29 17:43
VLAI
EPSS
VEX
Title
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.
Severity
7.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/52480 | x_refsource_MISC |
| https://github.com/electron/electron/commit/00045… | x_refsource_MISC |
| https://github.com/electron/electron/commit/25ba8… | x_refsource_MISC |
| https://github.com/electron/electron/commit/c38d6… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003e= 42.3.3, \u003c 42.10.0"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-beta.1, \u003c 43.5.0"
},
{
"status": "affected",
"version": "\u003e= 44.0.0-alpha.1, \u003c 44.0.0-beta.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron\u0027s sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer\u0027s code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:43:26.960Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq"
},
{
"name": "https://github.com/electron/electron/pull/52480",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/52480"
},
{
"name": "https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601"
},
{
"name": "https://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3"
},
{
"name": "https://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.10.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.10.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.5.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.5.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.6"
}
],
"source": {
"advisory": "GHSA-qmv3-fv6v-rmhq",
"discovery": "UNKNOWN"
},
"title": "Electron: Sandboxed preload code cache can be poisoned by a compromised renderer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102677",
"datePublished": "2026-09-29T17:43:26.960Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-29T17:43:26.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102676 (GCVE-0-2026-102676)
Vulnerability from nvd – Published: 2026-09-29 16:56 – Updated: 2026-09-29 19:50
VLAI
EPSS
VEX
Title
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 19:50 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/6462a… | x_refsource_MISC |
| https://github.com/electron/electron/commit/9a675… | x_refsource_MISC |
| https://github.com/electron/electron/commit/b3ae0… | x_refsource_MISC |
| https://github.com/electron/electron/commit/cd34f… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102676",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T19:50:13.282220Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T19:50:28.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 41.10.6"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.9.2"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.4.1"
},
{
"status": "affected",
"version": "\u003e= 44.0.0-alpha.1, \u003c 44.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron \u003cwebview\u003e guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the \u003cwebview\u003e tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188: Insecure Default Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T16:56:49.007Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w"
},
{
"name": "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2"
},
{
"name": "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671"
},
{
"name": "https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886"
},
{
"name": "https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.6"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.4.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"
}
],
"source": {
"advisory": "GHSA-9qh4-3jw8-366w",
"discovery": "UNKNOWN"
},
"title": "Electron: \u003cwebview\u003e can enable Node.js integration in Web Workers despite embedder restrictions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102676",
"datePublished": "2026-09-29T16:56:49.007Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-29T19:50:28.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102675 (GCVE-0-2026-102675)
Vulnerability from nvd – Published: 2026-09-29 16:54 – Updated: 2026-09-29 17:26
VLAI
EPSS
VEX
Title
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 17:25 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/4d278… | x_refsource_MISC |
| https://github.com/electron/electron/commit/80178… | x_refsource_MISC |
| https://github.com/electron/electron/commit/c595b… | x_refsource_MISC |
| https://github.com/electron/electron/commit/ef75c… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102675",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T17:25:31.410322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:26:51.547Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 41.10.6"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.9.2"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.4.1"
},
{
"status": "affected",
"version": "\u003e= 44.0.0-alpha.1, \u003c 44.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T16:54:29.218Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj"
},
{
"name": "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d"
},
{
"name": "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d"
},
{
"name": "https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397"
},
{
"name": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.6"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.4.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"
}
],
"source": {
"advisory": "GHSA-j84w-jfhq-vhvj",
"discovery": "UNKNOWN"
},
"title": "Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102675",
"datePublished": "2026-09-29T16:54:29.218Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-29T17:26:51.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102674 (GCVE-0-2026-102674)
Vulnerability from nvd – Published: 2026-09-29 16:51 – Updated: 2026-09-29 17:20
VLAI
EPSS
VEX
Title
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 17:20 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/29fc1… | x_refsource_MISC |
| https://github.com/electron/electron/commit/3ecf3… | x_refsource_MISC |
| https://github.com/electron/electron/commit/6594d… | x_refsource_MISC |
| https://github.com/electron/electron/commit/e9c4d… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T17:20:28.745285Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:20:35.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 41.10.6"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.9.2"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.4.1"
},
{
"status": "affected",
"version": "\u003e= 44.0.0-alpha.1, \u003c 44.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document\u0027s active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application\u0027s full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266: Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T16:51:26.963Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685"
},
{
"name": "https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2"
},
{
"name": "https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d"
},
{
"name": "https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886"
},
{
"name": "https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.6"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.4.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"
}
],
"source": {
"advisory": "GHSA-gr2m-v5gq-v685",
"discovery": "UNKNOWN"
},
"title": "Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102674",
"datePublished": "2026-09-29T16:51:26.963Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-29T17:20:35.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102673 (GCVE-0-2026-102673)
Vulnerability from nvd – Published: 2026-09-29 16:38 – Updated: 2026-09-30 20:11
VLAI
EPSS
VEX
Title
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 19:34 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/52133 | x_refsource_MISC |
| https://github.com/electron/electron/commit/7ea14… | x_refsource_MISC |
| https://github.com/electron/electron/commit/e26b2… | x_refsource_MISC |
| https://github.com/electron/electron/commit/ebe11… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102673",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T19:34:09.694143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T20:11:08.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 41.10.4"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.5.2"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron\u0027s OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application\u0027s full origin, exposing that origin\u0027s cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T16:38:41.946Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4"
},
{
"name": "https://github.com/electron/electron/pull/52133",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/52133"
},
{
"name": "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba"
},
{
"name": "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69"
},
{
"name": "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.4"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.5.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.5.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.0.0"
}
],
"source": {
"advisory": "GHSA-hq2x-r82h-9wj4",
"discovery": "UNKNOWN"
},
"title": "Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102673",
"datePublished": "2026-09-29T16:38:41.946Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-30T20:11:08.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70612 (GCVE-0-2026-70612)
Vulnerability from nvd – Published: 2026-08-05 17:56 – Updated: 2026-08-05 19:03
VLAI
EPSS
VEX
Title
Electron: Sandboxed iframes can launch external protocol handlers
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 19:03 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50961 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50962 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50963 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50964 | x_refsource_MISC |
| https://github.com/electron/electron/commit/08b9d… | x_refsource_MISC |
| https://github.com/electron/electron/commit/2764e… | x_refsource_MISC |
| https://github.com/electron/electron/commit/477dc… | x_refsource_MISC |
| https://github.com/electron/electron/commit/c39e3… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T19:03:22.677858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T19:03:29.121Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:56:41.464Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp"
},
{
"name": "https://github.com/electron/electron/pull/50961",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50961"
},
{
"name": "https://github.com/electron/electron/pull/50962",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50962"
},
{
"name": "https://github.com/electron/electron/pull/50963",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50963"
},
{
"name": "https://github.com/electron/electron/pull/50964",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50964"
},
{
"name": "https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5"
},
{
"name": "https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a"
},
{
"name": "https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39"
},
{
"name": "https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.8"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-p2rr-rvmm-c5fp",
"discovery": "UNKNOWN"
},
"title": "Electron: Sandboxed iframes can launch external protocol handlers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70612",
"datePublished": "2026-08-05T17:56:41.464Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-05T19:03:29.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70611 (GCVE-0-2026-70611)
Vulnerability from nvd – Published: 2026-08-05 17:49 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Electron: DevTools embedder handler executes arbitrary files via shell open
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
Severity
6.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50937 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50938 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51114 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51115 | x_refsource_MISC |
| https://github.com/electron/electron/commit/10fb5… | x_refsource_MISC |
| https://github.com/electron/electron/commit/1b8a2… | x_refsource_MISC |
| https://github.com/electron/electron/commit/27bf1… | x_refsource_MISC |
| https://github.com/electron/electron/commit/7a1eb… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:50.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.9"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.2"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:49:09.144Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp"
},
{
"name": "https://github.com/electron/electron/pull/50937",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50937"
},
{
"name": "https://github.com/electron/electron/pull/50938",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50938"
},
{
"name": "https://github.com/electron/electron/pull/51114",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51114"
},
{
"name": "https://github.com/electron/electron/pull/51115",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51115"
},
{
"name": "https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322"
},
{
"name": "https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771"
},
{
"name": "https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44"
},
{
"name": "https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.9"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-f2r8-jv7c-xqmp",
"discovery": "UNKNOWN"
},
"title": "Electron: DevTools embedder handler executes arbitrary files via shell open"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70611",
"datePublished": "2026-08-05T17:49:09.144Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-06T03:55:50.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70610 (GCVE-0-2026-70610)
Vulnerability from nvd – Published: 2026-08-05 17:41 – Updated: 2026-08-06 14:31
VLAI
EPSS
VEX
Title
Electron: contextBridge object copy honors prototype setters
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 14:30 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/51083 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51084 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51085 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51086 | x_refsource_MISC |
| https://github.com/electron/electron/commit/17d5d… | x_refsource_MISC |
| https://github.com/electron/electron/commit/23a6e… | x_refsource_MISC |
| https://github.com/electron/electron/commit/4ac50… | x_refsource_MISC |
| https://github.com/electron/electron/commit/5b699… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T14:30:58.717300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:31:10.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.9"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.2"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.2"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:41:03.016Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4"
},
{
"name": "https://github.com/electron/electron/pull/51083",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51083"
},
{
"name": "https://github.com/electron/electron/pull/51084",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51084"
},
{
"name": "https://github.com/electron/electron/pull/51085",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51085"
},
{
"name": "https://github.com/electron/electron/pull/51086",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51086"
},
{
"name": "https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713"
},
{
"name": "https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd"
},
{
"name": "https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55"
},
{
"name": "https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.9"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.4"
}
],
"source": {
"advisory": "GHSA-ff2p-hmqr-hxm4",
"discovery": "UNKNOWN"
},
"title": "Electron: contextBridge object copy honors prototype setters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70610",
"datePublished": "2026-08-05T17:41:03.016Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-06T14:31:10.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70609 (GCVE-0-2026-70609)
Vulnerability from nvd – Published: 2026-08-05 17:32 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50665 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50666 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50667 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50668 | x_refsource_MISC |
| https://github.com/electron/electron/commit/04614… | x_refsource_MISC |
| https://github.com/electron/electron/commit/2046a… | x_refsource_MISC |
| https://github.com/electron/electron/commit/96974… | x_refsource_MISC |
| https://github.com/electron/electron/commit/efc4d… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70609",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:49.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.7"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:32:21.067Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m"
},
{
"name": "https://github.com/electron/electron/pull/50665",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50665"
},
{
"name": "https://github.com/electron/electron/pull/50666",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50666"
},
{
"name": "https://github.com/electron/electron/pull/50667",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50667"
},
{
"name": "https://github.com/electron/electron/pull/50668",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50668"
},
{
"name": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1"
},
{
"name": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b"
},
{
"name": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce"
},
{
"name": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.7"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.1"
}
],
"source": {
"advisory": "GHSA-4f78-qhmw-8j8m",
"discovery": "UNKNOWN"
},
"title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70609",
"datePublished": "2026-08-05T17:32:21.067Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-06T03:55:49.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70608 (GCVE-0-2026-70608)
Vulnerability from nvd – Published: 2026-08-05 17:27 – Updated: 2026-08-05 18:46
VLAI
EPSS
VEX
Title
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:14 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/51437 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51438 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51439 | x_refsource_MISC |
| https://github.com/electron/electron/commit/3ff23… | x_refsource_MISC |
| https://github.com/electron/electron/commit/57cbe… | x_refsource_MISC |
| https://github.com/electron/electron/commit/68cf8… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:14:00.193334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:46:49.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.10"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 41.10.3"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:27:15.743Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g"
},
{
"name": "https://github.com/electron/electron/pull/51437",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51437"
},
{
"name": "https://github.com/electron/electron/pull/51438",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51438"
},
{
"name": "https://github.com/electron/electron/pull/51439",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51439"
},
{
"name": "https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57"
},
{
"name": "https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3"
},
{
"name": "https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.10"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.3"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.1"
}
],
"source": {
"advisory": "GHSA-9f4c-93c8-jc8g",
"discovery": "UNKNOWN"
},
"title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70608",
"datePublished": "2026-08-05T17:27:15.743Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-05T18:46:49.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70607 (GCVE-0-2026-70607)
Vulnerability from nvd – Published: 2026-08-05 16:24 – Updated: 2026-08-05 18:27
VLAI
EPSS
VEX
Title
Electron: window.open features string controls some window options considered privileged
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:27 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50946 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50947 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50948 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50949 | x_refsource_MISC |
| https://github.com/electron/electron/commit/30cf3… | x_refsource_MISC |
| https://github.com/electron/electron/commit/4eff3… | x_refsource_MISC |
| https://github.com/electron/electron/commit/615d6… | x_refsource_MISC |
| https://github.com/electron/electron/commit/fe2e7… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:27:03.596456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:27:13.014Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:24:11.939Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj"
},
{
"name": "https://github.com/electron/electron/pull/50946",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50946"
},
{
"name": "https://github.com/electron/electron/pull/50947",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50947"
},
{
"name": "https://github.com/electron/electron/pull/50948",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50948"
},
{
"name": "https://github.com/electron/electron/pull/50949",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50949"
},
{
"name": "https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a"
},
{
"name": "https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7"
},
{
"name": "https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b"
},
{
"name": "https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.8"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-v93f-fgjr-hjrj",
"discovery": "UNKNOWN"
},
"title": "Electron: window.open features string controls some window options considered privileged"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70607",
"datePublished": "2026-08-05T16:24:11.939Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-05T18:27:13.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70606 (GCVE-0-2026-70606)
Vulnerability from nvd – Published: 2026-08-05 16:07 – Updated: 2026-08-05 17:23
VLAI
EPSS
VEX
Title
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 17:15 UTC
CWE
- CWE-668 - Exposure of Resource to Wrong Sphere
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70606",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T17:15:44.765454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:23:30.639Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.10.6"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.9.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.5.1"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:07:46.008Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-r4w5-6pfg-jxp5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-r4w5-6pfg-jxp5"
}
],
"source": {
"advisory": "GHSA-r4w5-6pfg-jxp5",
"discovery": "UNKNOWN"
},
"title": "Electron: ProtocolResponse.url reuses the default session cache instead of the registering session"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70606",
"datePublished": "2026-08-05T16:07:46.008Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T17:23:30.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70605 (GCVE-0-2026-70605)
Vulnerability from nvd – Published: 2026-08-05 16:04 – Updated: 2026-08-06 14:24
VLAI
EPSS
VEX
Title
Electron: HTTP redirect followed into local file loader
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 14:23 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70605",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T14:23:48.944947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:24:06.012Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:04:12.428Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-v64r-4m7r-3mvq"
}
],
"source": {
"advisory": "GHSA-v64r-4m7r-3mvq",
"discovery": "UNKNOWN"
},
"title": "Electron: HTTP redirect followed into local file loader"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70605",
"datePublished": "2026-08-05T16:04:12.428Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-06T14:24:06.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70604 (GCVE-0-2026-70604)
Vulnerability from nvd – Published: 2026-08-05 15:59 – Updated: 2026-08-05 18:41
VLAI
EPSS
VEX
Title
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:13 UTC
CWE
- CWE-942 - Permissive Cross-domain Policy with Untrusted Domains
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:13:52.321211Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:41:32.481Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.10"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.3"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.4.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-942",
"description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:59:24.043Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw"
}
],
"source": {
"advisory": "GHSA-v3j7-r9gq-3gjw",
"discovery": "UNKNOWN"
},
"title": "Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70604",
"datePublished": "2026-08-05T15:59:24.043Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T18:41:32.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70603 (GCVE-0-2026-70603)
Vulnerability from nvd – Published: 2026-08-05 15:56 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Electron: shell.openPath path validation bypass via embedded null byte
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1.
Severity
6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:27.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.6"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.1.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input to shell.openPath() and rely on string-based validation without a filesystem check. This issue is fixed in versions 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158: Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:56:50.574Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-5c9j-mhmv-5xgx"
}
],
"source": {
"advisory": "GHSA-5c9j-mhmv-5xgx",
"discovery": "UNKNOWN"
},
"title": "Electron: shell.openPath path validation bypass via embedded null byte"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70603",
"datePublished": "2026-08-05T15:56:50.574Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-06T03:55:27.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70602 (GCVE-0-2026-70602)
Vulnerability from nvd – Published: 2026-08-05 15:54 – Updated: 2026-08-05 16:13
VLAI
EPSS
VEX
Title
Electron: Extension tab APIs operate across session boundaries
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 16:12 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70602",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T16:12:59.028629Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:13:06.513Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension\u0027s own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:54:49.931Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-m55f-7gqj-fr98"
}
],
"source": {
"advisory": "GHSA-m55f-7gqj-fr98",
"discovery": "UNKNOWN"
},
"title": "Electron: Extension tab APIs operate across session boundaries"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70602",
"datePublished": "2026-08-05T15:54:49.931Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T16:13:06.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70601 (GCVE-0-2026-70601)
Vulnerability from nvd – Published: 2026-08-05 15:45 – Updated: 2026-08-05 17:30
VLAI
EPSS
VEX
Title
Electron: Context isolation bypass via Function.prototype.bind hijack
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 17:29 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70601",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T17:29:54.563592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:30:28.446Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.9"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.2"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.2"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:45:31.315Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x"
}
],
"source": {
"advisory": "GHSA-h7rp-cf8h-j98x",
"discovery": "UNKNOWN"
},
"title": "Electron: Context isolation bypass via Function.prototype.bind hijack"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70601",
"datePublished": "2026-08-05T15:45:31.315Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T17:30:28.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70600 (GCVE-0-2026-70600)
Vulnerability from nvd – Published: 2026-08-05 15:40 – Updated: 2026-08-06 14:21
VLAI
EPSS
VEX
Title
Electron: Cross-origin iframe can position native autofill popup
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 14:21 UTC
CWE
- CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70600",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T14:21:34.549765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:21:44.543Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe\u0027s bounds, over the embedding page\u0027s UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:40:27.570Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf"
}
],
"source": {
"advisory": "GHSA-x8rc-wpg4-grpf",
"discovery": "UNKNOWN"
},
"title": "Electron: Cross-origin iframe can position native autofill popup"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70600",
"datePublished": "2026-08-05T15:40:27.570Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-06T14:21:44.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70599 (GCVE-0-2026-70599)
Vulnerability from nvd – Published: 2026-08-05 15:36 – Updated: 2026-08-05 18:41
VLAI
EPSS
VEX
Title
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:13 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/0cbdf… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:13:54.699962Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:41:57.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.7"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T15:36:02.182Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp"
},
{
"name": "https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c"
}
],
"source": {
"advisory": "GHSA-9pf5-hg6p-4pwp",
"discovery": "UNKNOWN"
},
"title": "Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70599",
"datePublished": "2026-08-05T15:36:02.182Z",
"dateReserved": "2026-08-04T19:50:27.328Z",
"dateUpdated": "2026-08-05T18:41:57.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102677 (GCVE-0-2026-102677)
Vulnerability from cvelistv5 – Published: 2026-09-29 17:43 – Updated: 2026-09-29 17:43
VLAI
EPSS
VEX
Title
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.
Severity
7.8 (High)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/52480 | x_refsource_MISC |
| https://github.com/electron/electron/commit/00045… | x_refsource_MISC |
| https://github.com/electron/electron/commit/25ba8… | x_refsource_MISC |
| https://github.com/electron/electron/commit/c38d6… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003e= 42.3.3, \u003c 42.10.0"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-beta.1, \u003c 43.5.0"
},
{
"status": "affected",
"version": "\u003e= 44.0.0-alpha.1, \u003c 44.0.0-beta.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron\u0027s sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer\u0027s code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:43:26.960Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq"
},
{
"name": "https://github.com/electron/electron/pull/52480",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/52480"
},
{
"name": "https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601"
},
{
"name": "https://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3"
},
{
"name": "https://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.10.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.10.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.5.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.5.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.6"
}
],
"source": {
"advisory": "GHSA-qmv3-fv6v-rmhq",
"discovery": "UNKNOWN"
},
"title": "Electron: Sandboxed preload code cache can be poisoned by a compromised renderer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102677",
"datePublished": "2026-09-29T17:43:26.960Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-29T17:43:26.960Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102676 (GCVE-0-2026-102676)
Vulnerability from cvelistv5 – Published: 2026-09-29 16:56 – Updated: 2026-09-29 19:50
VLAI
EPSS
VEX
Title
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 19:50 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/6462a… | x_refsource_MISC |
| https://github.com/electron/electron/commit/9a675… | x_refsource_MISC |
| https://github.com/electron/electron/commit/b3ae0… | x_refsource_MISC |
| https://github.com/electron/electron/commit/cd34f… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102676",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T19:50:13.282220Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T19:50:28.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 41.10.6"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.9.2"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.4.1"
},
{
"status": "affected",
"version": "\u003e= 44.0.0-alpha.1, \u003c 44.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron \u003cwebview\u003e guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the \u003cwebview\u003e tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188: Insecure Default Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T16:56:49.007Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w"
},
{
"name": "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2"
},
{
"name": "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671"
},
{
"name": "https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886"
},
{
"name": "https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.6"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.4.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"
}
],
"source": {
"advisory": "GHSA-9qh4-3jw8-366w",
"discovery": "UNKNOWN"
},
"title": "Electron: \u003cwebview\u003e can enable Node.js integration in Web Workers despite embedder restrictions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102676",
"datePublished": "2026-09-29T16:56:49.007Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-29T19:50:28.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102675 (GCVE-0-2026-102675)
Vulnerability from cvelistv5 – Published: 2026-09-29 16:54 – Updated: 2026-09-29 17:26
VLAI
EPSS
VEX
Title
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 17:25 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/4d278… | x_refsource_MISC |
| https://github.com/electron/electron/commit/80178… | x_refsource_MISC |
| https://github.com/electron/electron/commit/c595b… | x_refsource_MISC |
| https://github.com/electron/electron/commit/ef75c… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102675",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T17:25:31.410322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:26:51.547Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 41.10.6"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.9.2"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.4.1"
},
{
"status": "affected",
"version": "\u003e= 44.0.0-alpha.1, \u003c 44.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T16:54:29.218Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj"
},
{
"name": "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d"
},
{
"name": "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d"
},
{
"name": "https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397"
},
{
"name": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.6"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.4.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"
}
],
"source": {
"advisory": "GHSA-j84w-jfhq-vhvj",
"discovery": "UNKNOWN"
},
"title": "Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102675",
"datePublished": "2026-09-29T16:54:29.218Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-29T17:26:51.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102674 (GCVE-0-2026-102674)
Vulnerability from cvelistv5 – Published: 2026-09-29 16:51 – Updated: 2026-09-29 17:20
VLAI
EPSS
VEX
Title
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 17:20 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/commit/29fc1… | x_refsource_MISC |
| https://github.com/electron/electron/commit/3ecf3… | x_refsource_MISC |
| https://github.com/electron/electron/commit/6594d… | x_refsource_MISC |
| https://github.com/electron/electron/commit/e9c4d… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T17:20:28.745285Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T17:20:35.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 41.10.6"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.9.2"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.4.1"
},
{
"status": "affected",
"version": "\u003e= 44.0.0-alpha.1, \u003c 44.0.0-beta.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document\u0027s active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application\u0027s full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266: Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T16:51:26.963Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685"
},
{
"name": "https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2"
},
{
"name": "https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d"
},
{
"name": "https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886"
},
{
"name": "https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.6"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.4.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"
}
],
"source": {
"advisory": "GHSA-gr2m-v5gq-v685",
"discovery": "UNKNOWN"
},
"title": "Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102674",
"datePublished": "2026-09-29T16:51:26.963Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-29T17:20:35.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102673 (GCVE-0-2026-102673)
Vulnerability from cvelistv5 – Published: 2026-09-29 16:38 – Updated: 2026-09-30 20:11
VLAI
EPSS
VEX
Title
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 19:34 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/52133 | x_refsource_MISC |
| https://github.com/electron/electron/commit/7ea14… | x_refsource_MISC |
| https://github.com/electron/electron/commit/e26b2… | x_refsource_MISC |
| https://github.com/electron/electron/commit/ebe11… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102673",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T19:34:09.694143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T20:11:08.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 41.10.4"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.5.2"
},
{
"status": "affected",
"version": "\u003e= 43.0.0-alpha.1, \u003c 43.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron\u0027s OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application\u0027s full origin, exposing that origin\u0027s cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T16:38:41.946Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4"
},
{
"name": "https://github.com/electron/electron/pull/52133",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/52133"
},
{
"name": "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba"
},
{
"name": "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69"
},
{
"name": "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.4"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.5.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.5.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v43.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v43.0.0"
}
],
"source": {
"advisory": "GHSA-hq2x-r82h-9wj4",
"discovery": "UNKNOWN"
},
"title": "Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102673",
"datePublished": "2026-09-29T16:38:41.946Z",
"dateReserved": "2026-09-29T16:10:04.075Z",
"dateUpdated": "2026-09-30T20:11:08.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70612 (GCVE-0-2026-70612)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:56 – Updated: 2026-08-05 19:03
VLAI
EPSS
VEX
Title
Electron: Sandboxed iframes can launch external protocol handlers
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 19:03 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50961 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50962 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50963 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50964 | x_refsource_MISC |
| https://github.com/electron/electron/commit/08b9d… | x_refsource_MISC |
| https://github.com/electron/electron/commit/2764e… | x_refsource_MISC |
| https://github.com/electron/electron/commit/477dc… | x_refsource_MISC |
| https://github.com/electron/electron/commit/c39e3… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T19:03:22.677858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T19:03:29.121Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:56:41.464Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp"
},
{
"name": "https://github.com/electron/electron/pull/50961",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50961"
},
{
"name": "https://github.com/electron/electron/pull/50962",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50962"
},
{
"name": "https://github.com/electron/electron/pull/50963",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50963"
},
{
"name": "https://github.com/electron/electron/pull/50964",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50964"
},
{
"name": "https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5"
},
{
"name": "https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a"
},
{
"name": "https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39"
},
{
"name": "https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.8"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-p2rr-rvmm-c5fp",
"discovery": "UNKNOWN"
},
"title": "Electron: Sandboxed iframes can launch external protocol handlers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70612",
"datePublished": "2026-08-05T17:56:41.464Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-05T19:03:29.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70611 (GCVE-0-2026-70611)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:49 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Electron: DevTools embedder handler executes arbitrary files via shell open
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
Severity
6.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50937 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50938 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51114 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51115 | x_refsource_MISC |
| https://github.com/electron/electron/commit/10fb5… | x_refsource_MISC |
| https://github.com/electron/electron/commit/1b8a2… | x_refsource_MISC |
| https://github.com/electron/electron/commit/27bf1… | x_refsource_MISC |
| https://github.com/electron/electron/commit/7a1eb… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:50.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.9"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.2"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:49:09.144Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-f2r8-jv7c-xqmp"
},
{
"name": "https://github.com/electron/electron/pull/50937",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50937"
},
{
"name": "https://github.com/electron/electron/pull/50938",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50938"
},
{
"name": "https://github.com/electron/electron/pull/51114",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51114"
},
{
"name": "https://github.com/electron/electron/pull/51115",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51115"
},
{
"name": "https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322"
},
{
"name": "https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771"
},
{
"name": "https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44"
},
{
"name": "https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.9"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-f2r8-jv7c-xqmp",
"discovery": "UNKNOWN"
},
"title": "Electron: DevTools embedder handler executes arbitrary files via shell open"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70611",
"datePublished": "2026-08-05T17:49:09.144Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-06T03:55:50.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70610 (GCVE-0-2026-70610)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:41 – Updated: 2026-08-06 14:31
VLAI
EPSS
VEX
Title
Electron: contextBridge object copy honors prototype setters
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 14:30 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/51083 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51084 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51085 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51086 | x_refsource_MISC |
| https://github.com/electron/electron/commit/17d5d… | x_refsource_MISC |
| https://github.com/electron/electron/commit/23a6e… | x_refsource_MISC |
| https://github.com/electron/electron/commit/4ac50… | x_refsource_MISC |
| https://github.com/electron/electron/commit/5b699… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T14:30:58.717300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:31:10.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.9"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.2"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.2"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:41:03.016Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4"
},
{
"name": "https://github.com/electron/electron/pull/51083",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51083"
},
{
"name": "https://github.com/electron/electron/pull/51084",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51084"
},
{
"name": "https://github.com/electron/electron/pull/51085",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51085"
},
{
"name": "https://github.com/electron/electron/pull/51086",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51086"
},
{
"name": "https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713"
},
{
"name": "https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd"
},
{
"name": "https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55"
},
{
"name": "https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.9"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.2"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.4"
}
],
"source": {
"advisory": "GHSA-ff2p-hmqr-hxm4",
"discovery": "UNKNOWN"
},
"title": "Electron: contextBridge object copy honors prototype setters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70610",
"datePublished": "2026-08-05T17:41:03.016Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-06T14:31:10.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70609 (GCVE-0-2026-70609)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:32 – Updated: 2026-08-06 03:55
VLAI
EPSS
VEX
Title
Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 00:00 UTC
CWE
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50665 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50666 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50667 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50668 | x_refsource_MISC |
| https://github.com/electron/electron/commit/04614… | x_refsource_MISC |
| https://github.com/electron/electron/commit/2046a… | x_refsource_MISC |
| https://github.com/electron/electron/commit/96974… | x_refsource_MISC |
| https://github.com/electron/electron/commit/efc4d… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70609",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:55:49.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.7"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.0"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:32:21.067Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m"
},
{
"name": "https://github.com/electron/electron/pull/50665",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50665"
},
{
"name": "https://github.com/electron/electron/pull/50666",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50666"
},
{
"name": "https://github.com/electron/electron/pull/50667",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50667"
},
{
"name": "https://github.com/electron/electron/pull/50668",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50668"
},
{
"name": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1"
},
{
"name": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b"
},
{
"name": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce"
},
{
"name": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.7"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.1"
}
],
"source": {
"advisory": "GHSA-4f78-qhmw-8j8m",
"discovery": "UNKNOWN"
},
"title": "Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70609",
"datePublished": "2026-08-05T17:32:21.067Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-06T03:55:49.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70608 (GCVE-0-2026-70608)
Vulnerability from cvelistv5 – Published: 2026-08-05 17:27 – Updated: 2026-08-05 18:46
VLAI
EPSS
VEX
Title
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:14 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/51437 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51438 | x_refsource_MISC |
| https://github.com/electron/electron/pull/51439 | x_refsource_MISC |
| https://github.com/electron/electron/commit/3ff23… | x_refsource_MISC |
| https://github.com/electron/electron/commit/57cbe… | x_refsource_MISC |
| https://github.com/electron/electron/commit/68cf8… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:14:00.193334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:46:49.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.10"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 41.10.3"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693: Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T17:27:15.743Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g"
},
{
"name": "https://github.com/electron/electron/pull/51437",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51437"
},
{
"name": "https://github.com/electron/electron/pull/51438",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51438"
},
{
"name": "https://github.com/electron/electron/pull/51439",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/51439"
},
{
"name": "https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57"
},
{
"name": "https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3"
},
{
"name": "https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.10"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.10.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.10.3"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.1"
}
],
"source": {
"advisory": "GHSA-9f4c-93c8-jc8g",
"discovery": "UNKNOWN"
},
"title": "Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70608",
"datePublished": "2026-08-05T17:27:15.743Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-05T18:46:49.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70607 (GCVE-0-2026-70607)
Vulnerability from cvelistv5 – Published: 2026-08-05 16:24 – Updated: 2026-08-05 18:27
VLAI
EPSS
VEX
Title
Electron: window.open features string controls some window options considered privileged
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 18:27 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/electron/electron/security/adv… | x_refsource_CONFIRM |
| https://github.com/electron/electron/pull/50946 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50947 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50948 | x_refsource_MISC |
| https://github.com/electron/electron/pull/50949 | x_refsource_MISC |
| https://github.com/electron/electron/commit/30cf3… | x_refsource_MISC |
| https://github.com/electron/electron/commit/4eff3… | x_refsource_MISC |
| https://github.com/electron/electron/commit/615d6… | x_refsource_MISC |
| https://github.com/electron/electron/commit/fe2e7… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
| https://github.com/electron/electron/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T18:27:03.596456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T18:27:13.014Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron",
"vendor": "electron",
"versions": [
{
"status": "affected",
"version": "\u003c 39.8.8"
},
{
"status": "affected",
"version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
},
{
"status": "affected",
"version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
},
{
"status": "affected",
"version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T16:24:11.939Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj"
},
{
"name": "https://github.com/electron/electron/pull/50946",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50946"
},
{
"name": "https://github.com/electron/electron/pull/50947",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50947"
},
{
"name": "https://github.com/electron/electron/pull/50948",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50948"
},
{
"name": "https://github.com/electron/electron/pull/50949",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/pull/50949"
},
{
"name": "https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a"
},
{
"name": "https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7"
},
{
"name": "https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b"
},
{
"name": "https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55"
},
{
"name": "https://github.com/electron/electron/releases/tag/v39.8.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v39.8.8"
},
{
"name": "https://github.com/electron/electron/releases/tag/v40.9.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v40.9.0"
},
{
"name": "https://github.com/electron/electron/releases/tag/v41.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v41.2.1"
},
{
"name": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
}
],
"source": {
"advisory": "GHSA-v93f-fgjr-hjrj",
"discovery": "UNKNOWN"
},
"title": "Electron: window.open features string controls some window options considered privileged"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70607",
"datePublished": "2026-08-05T16:24:11.939Z",
"dateReserved": "2026-08-04T19:50:27.329Z",
"dateUpdated": "2026-08-05T18:27:13.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}