Cross-Site Scripting Vulnerability in Electron Framework
CVE-2026-70607

5.3MEDIUM

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70607?

A security issue in the Electron framework, prior to specific updates, permits untrusted web content to set window options inappropriately via the window.open() method. This misconfiguration could allow attackers to trigger the main process to access unauthorized file or network paths. To mitigate this security risk, it is crucial to upgrade to the fixed versions: 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

Affected Version(s)

electron < 39.8.8 < 39.8.8

electron >= 40.0.0-alpha.1, < 40.9.0 < 40.0.0-alpha.1, 40.9.0

electron >= 41.0.0-alpha.1, < 41.2.1 < 41.0.0-alpha.1, 41.2.1

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM
https://github.com/electron/electron/pull/50946
x_refsource_MISC
https://github.com/electron/electron/pull/50947
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.