{"id":"CVE-2026-70601","title":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS","summary":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","cwe":["CWE-693"],"vendor":"electron","product":"electron","affected":["electron < 39.8.9","electron >= 40.0.0-alpha.1, < 40.9.2","electron >= 41.0.0-alpha.1, < 41.2.2","electron >= 42.0.0-alpha.1, < 42.0.0-beta.5"],"patched":["electron 39.8.9","electron 40.9.2","electron 41.2.2","electron 42.0.0-beta.5"],"published":"2026-08-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:44:08.253","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70601","references":[{"url":"https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-h7rp-cf8h-j98x"}],"tags":["nvd","ghsa","npm"],"epss":0.00245,"epssPercentile":0.15967,"aliases":["GHSA-h7rp-cf8h-j98x"],"ecosystem":"npm","ingestedAt":"2026-08-05T15:49:00.527Z","slug":"CVE-2026-70601","body":"## Overview\n\nElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-70601)\n\nAffected packages:\n\n- `electron < 39.8.9`\n- `electron >= 40.0.0-alpha.1, < 40.9.2`\n- `electron >= 41.0.0-alpha.1, < 41.2.2`\n- `electron >= 42.0.0-alpha.1, < 42.0.0-beta.5`\n\nPatched in:\n\n- `electron 39.8.9`\n- `electron 40.9.2`\n- `electron 41.2.2`\n- `electron 42.0.0-beta.5`\n\nSource: https://github.com/advisories/GHSA-h7rp-cf8h-j98x","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}