WebContents DevTools Security Flaw in Electron Framework
CVE-2026-70609
5.7MEDIUM
What is CVE-2026-70609?
The Electron framework for crafting cross-platform desktop applications is affected by an improper input validation vulnerability linked to the 'mode' option in the webContents.openDevTools() method. If an attacker can manipulate this value, they could execute their scripts in the DevTools context. This is particularly concerning in unsandboxed environments where the Node.js process is accessible. It is crucial to ensure that users update to versions 39.8.7, 40.9.0, 41.2.0, or 42.0.0-beta.1 or later to mitigate this risk.
Affected Version(s)
electron < 39.8.7 < 39.8.7
electron >= 40.0.0-alpha.1, < 40.9.0 < 40.0.0-alpha.1, 40.9.0
electron >= 41.0.0-alpha.1, < 41.2.0 < 41.0.0-alpha.1, 41.2.0