Cross-platform Desktop Application Framework Vulnerability in Electron
CVE-2026-70606

5.9MEDIUM

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70606?

The Electron framework, used for developing cross-platform desktop applications, has a vulnerability related to improper session isolation in its protocol handling. If a custom protocol handler returns a ProtocolResponse with a URL and lacks a designated session, Electron inadvertently processes requests via the defaultSession. This flaw can lead to a cached response being reused among isolated session partitions, thus potentially exposing sensitive data. The issue affects apps that rely on ProtocolResponse.url and do not specify ProtocolResponse.session, allowing for unintended data access. This vulnerability has been addressed in updates released in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.

Affected Version(s)

electron >= 40.0.0-alpha.1, < 40.10.6 < 40.0.0-alpha.1, 40.10.6

electron >= 41.0.0-alpha.1, < 41.9.1 < 41.0.0-alpha.1, 41.9.1

electron >= 42.0.0-alpha.1, < 42.5.1 < 42.0.0-alpha.1, 42.5.1

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.