Cross-Site Scripting in Electron Framework Affects Multiple Versions
CVE-2026-70602

6.6MEDIUM

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70602?

The Electron framework, a widely-used tool for building desktop applications with web technologies, has a vulnerability in its extension handling. Versions before 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 allow extensions loaded into one session to access and manipulate content in another session. This could let malicious extensions navigate or read from windows belonging to a different session, potentially exposing sensitive data or allowing unwanted actions to be executed. Users are advised to update to the latest versions to mitigate this risk.

Affected Version(s)

electron < 39.8.8 < 39.8.8

electron >= 40.0.0-alpha.1, < 40.9.0 < 40.0.0-alpha.1, 40.9.0

electron >= 41.0.0-alpha.1, < 41.2.1 < 41.0.0-alpha.1, 41.2.1

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.