Clickjacking Vulnerability in Electron Framework by GitHub
CVE-2026-70600
What is CVE-2026-70600?
The Electron framework, used for building cross-platform desktop applications, has a vulnerability that allows the native autofill popup to be manipulated by a cross-origin iframe. This positioning issue can occur outside the iframe's designated bounds, potentially overlaying the embedding application's user interface. This vulnerability enables malicious actors to perform clickjacking, whereby users may be tricked into interacting with deceptive user interfaces. Applications that utilize untrusted content in iframes along with displaying trusted user interfaces are particularly at risk. Developers are advised to ensure their applications do not embed untrusted third-party content to maintain effective security. The issue has been addressed in multiple software updates: 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Affected Version(s)
electron < 39.8.8 < 39.8.8
electron >= 40.0.0-alpha.1, < 40.9.0 < 40.0.0-alpha.1, 40.9.0
electron >= 41.0.0-alpha.1, < 41.2.1 < 41.0.0-alpha.1, 41.2.1