Context Isolation Bypass in Electron Framework Affects Cross-Platform Applications
CVE-2026-70601

7.5HIGH

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70601?

The Electron framework, used for building cross-platform desktop applications with JavaScript, HTML, and CSS, has a vulnerability that arises when apps expose Promise-returning functions via contextBridge to web content. Prior to specific updates, this could allow untrusted web content to access the isolated preload environment. If a renderer does not utilize sandboxing or has nodeIntegration enabled, this can result in unauthorized access to Node.js features, posing a significant risk in applications using untrusted content. This issue is resolved in the latest versions of Electron.

Affected Version(s)

electron < 39.8.9 < 39.8.9

electron >= 40.0.0-alpha.1, < 40.9.2 < 40.0.0-alpha.1, 40.9.2

electron >= 41.0.0-alpha.1, < 41.2.2 < 41.0.0-alpha.1, 41.2.2

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.