Prototype Pollution Vulnerability in Electron Framework
CVE-2026-70610
What is CVE-2026-70610?
The Electron framework, used for building cross-platform applications, has a vulnerability that allows for prototype pollution via the contextBridge. This issue arises when untrusted content is accepted and processed in a way that could let an attacker influence object prototypes. While the context isolation feature is enabled to mitigate risks, applications that do not properly validate incoming object properties may still be vulnerable. It's crucial for developers to upgrade to versions 39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.4 to address this vulnerability and ensure safer application interactions.
Affected Version(s)
electron < 39.8.9 < 39.8.9
electron >= 40.0.0-alpha.1, < 40.9.2 < 40.0.0-alpha.1, 40.9.2
electron >= 41.0.0-alpha.1, < 41.2.2 < 41.0.0-alpha.1, 41.2.2