Improper Restriction of Rendered UI Layers or Frames

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the OpenURL navigation path, which allows a sandboxed iframe withou...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-70608 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-70608 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

pixlab-pet (0.2.0) potentially affected by CVE-2026-70608 via electron (42.0.0)

electron NPM version 42.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - pixlab-pet 0.2.0 Source cves: CVE-2026-70608 Source advisory: OSV:GHSA-9F4C-93C8-JC8G...

@ascua/electron (>=0.8.0, <=0.18.0), @barnaby.build/barnaby (>=0.0.131, <=0.0.253) +63 more potentially affected by CVE-2026-70608 via electron (>=40.0.0, <=41.7.1)

electron NPM version =40.0.0, =0.8.0, =0.0.131, =1.1.1, =0.1.6, =0.28.2-next.1.g0672c8f47, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.4.2, =0.11.0, =9.10.13-beta.1, =9.10.13-beta.1, =0.6.1, =1.0.0 and more Source cves: CVE-2026-70608 Source advisory: GHSA-9F4C-93C8-JC8G...

Improper Restriction of Rendered UI Layers or Frames

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the OpenURL navigation path, which allows a sandbox...

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

@ascua/electron (>=0.8.0, <=0.18.0), @barnaby.build/barnaby (>=0.0.131, <=0.0.253) +63 more potentially affected by CVE-2026-70608 via electron (>=40.0.0, <=41.7.1)

electron NPM version =40.0.0, =0.8.0, =0.0.131, =1.1.1, =0.1.6, =0.28.2-next.1.g0672c8f47, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.4.2, =0.11.0, =9.10.13-beta.1, =9.10.13-beta.1, =0.6.1, =1.0.0 and more Source cves: CVE-2026-70608 Source advisory: SNYK:JS-ELECTRON-18563343...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-70608 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

@ascua/electron (>=0.8.0, <=0.18.0), @barnaby.build/barnaby (>=0.0.131, <=0.0.253) +63 more potentially affected by CVE-2026-70608 via electron (>=40.0.0, <=41.7.1)

electron NPM version =40.0.0, =0.8.0, =0.0.131, =1.1.1, =0.1.6, =0.28.2-next.1.g0672c8f47, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.4.2, =0.11.0, =9.10.13-beta.1, =9.10.13-beta.1, =0.6.1, =1.0.0 and more Source cves: CVE-2026-70608 Source advisory: OSV:GHSA-9F4C-93C8-JC8G...

pixlab-pet (0.2.0) potentially affected by CVE-2026-70608 via electron (42.0.0)

electron NPM version 42.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - pixlab-pet 0.2.0 Source cves: CVE-2026-70608 Source advisory: SNYK:JS-ELECTRON-18563343...

pixlab-pet (0.2.0) potentially affected by CVE-2026-70608 via electron (42.0.0)

electron NPM version 42.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - pixlab-pet 0.2.0 Source cves: CVE-2026-70608 Source advisory: GHSA-9F4C-93C8-JC8G...

@ascua/electron (>=0.8.0, <=0.18.0), @barnaby.build/barnaby (>=0.0.131, <=0.0.253) +63 more potentially affected by CVE-2026-70608 via electron (>=40.0.0, <=41.7.1)

electron NPM version =40.0.0, =0.8.0, =0.0.131, =1.1.1, =0.1.6, =0.28.2-next.1.g0672c8f47, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.4.2, =0.11.0, =9.10.13-beta.1, =9.10.13-beta.1, =0.6.1, =1.0.0 and more Source cves: CVE-2026-70608 Source advisory: MEND:CVE-2026-70608...

CVE-2026-70608

Summary: Electron before versions 39.8.10, 41.10.3, and 42.0.1 allowed a sandboxed iframe without the allow-popups keyword to open a new window or trigger setWindowOpenHandler with no user interaction via OpenURL navigation, bypassing the iframe popup restriction. What’s affected: Electron apps e...

CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

EUVD-2026-53564

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

CVE-2026-70608

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

0.app1 (1.0.52), 0.edsql (>=1.0.49, <=1.0.50) +2982 more potentially affected by CVE-2026-70608 via electron (>=0.1.2, <=39.2.7)

electron NPM version =0.1.2, =1.0.49, =1.0.49, =1.0.49, =1.0.1, =0.0.10, =1.0.2, =1.1.11, =0.1.0, =1.0.1 - @aaquib/whatsasenanpm 1.3.5 - @aaronngray/electron-spawn 5.0.0 and more Source cves: CVE-2026-70608 Source advisory: MEND:CVE-2026-70608...