Cross-Site Scripting Vulnerability in Electron Framework
CVE-2026-70608
7.2HIGH
What is CVE-2026-70608?
The Electron framework, which enables the creation of cross-platform desktop applications using web technologies, previously allowed sandboxed iframes without the 'allow-popups' attribute to bypass restrictions. This vulnerability posed a risk for applications utilizing untrusted content in these iframes, enabling potential unauthorized window openings or interactions through setWindowOpenHandler without user consent. Fortunately, this issue has been resolved in the latest versions of Electron: 39.8.10, 41.10.3, and 42.0.1, ensuring better security for developers and users.
Affected Version(s)
electron < 39.8.10 < 39.8.10
electron >= 40.0.0-alpha.1, < 41.10.3 < 40.0.0-alpha.1, 41.10.3
electron >= 42.0.0-alpha.1, < 42.0.1 < 42.0.0-alpha.1, 42.0.1