CVE-2026-70601
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
electronnpm | < 39.8.9 | 39.8.9 |
electronnpm | >= 40.0.0-alpha.1, < 40.9.2 | 40.9.2 |
electronnpm | >= 41.0.0-alpha.1, < 41.2.2 | 41.2.2 |
electronnpm | >= 42.0.0-alpha.1, < 42.0.0-beta.5 | 42.0.0-beta.5 |
Affected products
12cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*+ 10 more
- cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*range: <39.8.9
- cpe:2.3:a:electronjs:electron:42.0.0:alpha1:*:*:*:node.js:*:*
- cpe:2.3:a:electronjs:electron:42.0.0:alpha2:*:*:*:node.js:*:*
- cpe:2.3:a:electronjs:electron:42.0.0:alpha3:*:*:*:node.js:*:*
- cpe:2.3:a:electronjs:electron:42.0.0:alpha4:*:*:*:node.js:*:*
- cpe:2.3:a:electronjs:electron:42.0.0:alpha5:*:*:*:node.js:*:*
- cpe:2.3:a:electronjs:electron:42.0.0:alpha6:*:*:*:node.js:*:*
- cpe:2.3:a:electronjs:electron:42.0.0:beta1:*:*:*:node.js:*:*
- cpe:2.3:a:electronjs:electron:42.0.0:beta2:*:*:*:node.js:*:*
- cpe:2.3:a:electronjs:electron:42.0.0:beta3:*:*:*:node.js:*:*
- cpe:2.3:a:electronjs:electron:42.0.0:beta4:*:*:*:node.js:*:*
- Range: <39.8.9, <40.9.2, <41.2.2, <42.0.0-beta.5
Patches
Vulnerability mechanics
References
2- github.com/advisories/GHSA-h7rp-cf8h-j98xghsaADVISORY
- github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98xnvdVendor AdvisoryWEB
News mentions
1- Electron Framework: 16 Vulnerabilities Disclosed, Including Sandbox Bypass and Prototype PollutionVypr Intelligence · Aug 5, 2026