CVE-2026-70612 json
Electron: Sandboxed iframes can launch external protocol handlers
published 2026-08-05 3 mo ago modified 2026-10-08 32 d ago also EUVD-2026-53546 , GHSA-p2rr-rvmm-c5fp
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Patch / fix
- npm electron 39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
- atom electron 39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
- electronjs electron 39.8.8, 40.9.0, 41.2.1, 42.0.0-beta.3
- github.com/electron/electron@08b9d0a commit
- github.com/electron/electron@2764e4c commit
- github.com/electron/electron@477dcf7 commit
- github.com/electron/electron@c39e3d5 commit
- github.com/electron/electron#50961 pull request
- github.com/electron/electron#50962 pull request
- github.com/electron/electron#50963 pull request
- github.com/electron/electron#50964 pull request
- github.com/electron/electron/releases/tag/v39.8.8 release
- github.com/electron/electron/releases/tag/v40.9.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | electron | <39.8.8 >=40.0.0-alpha.1, <40.9.0 >=41.0.0-alpha.1, <41.2.1 >=42.0.0-alpha.1, <42.0.0-beta.3 |
39.8.8 40.9.0 41.2.1 42.0.0-beta.3 |
Affected products
- electron electron
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/electron/electron/pull/50961
web, issue-tracking, patch
-
github.com
/electron/electron/pull/50962
web, issue-tracking, patch
-
github.com
/electron/electron/pull/50963
web, issue-tracking, patch
-
github.com
/electron/electron/pull/50964
web, issue-tracking, patch
-
github.com
/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5
web, patch
-
github.com
/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a
web, patch
-
github.com
/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39
web, patch
-
github.com
/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3
web, patch
-
github.com
/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp
web, vendor-advisory, mitigation
-
github.com
/electron/electron/releases/tag/v39.8.8
web, release-notes
-
github.com
/electron/electron/releases/tag/v40.9.0
web, release-notes
-
github.com
/electron/electron/releases/tag/v41.2.1
web, release-notes
-
github.com
/electron/electron/releases/tag/v42.0.0-beta.3
web, release-notes
-
github.com
/electron/electron
package
Sources
- CVE List CVE-2026-70612
- GitHub Advisory GHSA-p2rr-rvmm-c5fp
- NVD CVE-2026-70612
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.