CVE-2026-70607 Electron: window.open features string controls some window options considered privileged

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...

CVE-2026-70607 Electron: window.open features string controls some window options considered privileged

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...

CVE-2026-70607 Electron: window.open features string controls some window options considered privileged

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +6 more potentially affected by CVE-2026-70607 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70607 Source advisory: MEND:CVE-2026-70607...

CVE-2026-70604

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...

CVE-2026-70605

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch and net.request did not restrict which schemes a redirect could target. A remote server could redire...

CVE-2026-70603

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, shell.openPath did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, for example...

CVE-2026-70601

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70602

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...

CVE-2026-70598

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, offscreen rendering frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could...

CVE-2026-70599

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of...

CVE-2026-70597

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that...

sunrize (>=2.1.6, <=2.1.9), x3d-image (>=3.0.23, <=3.0.26) potentially affected by CVE-2026-70606 via electron (43.0.0-beta.3)

electron NPM version 43.0.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - sunrize =2.1.6, =3.0.23, =3.0.26 Source cves: CVE-2026-70606 Source advisory: OSV:GHSA-R4W5-6PFG-JXP5...

Authentication Bypass by Primary Weakness

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the ProtocolResponse.url when a custom protocol handler omits the session...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +12 more potentially affected by CVE-2026-70606 via electron (>=40.0.0, <=40.10.2)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =0.15.0, =1.142.0, =0.1.5, =40.1.0, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70606 Source advisory: GHSA-R4W5-6PFG-JXP5...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +11 more potentially affected by CVE-2026-70606 via electron (>=42.0.0, <=42.4.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.1.20 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-70606 Source advisory: GHSA-R4W5-6PFG-JXP5...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +11 more potentially affected by CVE-2026-70606 via electron (>=42.0.0, <=42.4.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.1.20 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-70606 Source advisory: SNYK:JS-ELECTRON-18563352...

@cafeai/cafe-code (0.0.28), @echomem/mcp (>=1.4.2, <=1.4.34) +8 more potentially affected by CVE-2026-70606 via electron (>=41.0.3, <=41.7.1)

electron NPM version =41.0.3, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70606 Source advisory: GHSA-R4W5-6PFG-JXP5...

@cafeai/cafe-code (0.0.28), @echomem/mcp (>=1.4.2, <=1.4.34) +8 more potentially affected by CVE-2026-70606 via electron (>=41.0.3, <=41.7.1)

electron NPM version =41.0.3, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70606 Source advisory: SNYK:JS-ELECTRON-18563352...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +12 more potentially affected by CVE-2026-70606 via electron (>=40.0.0, <=40.10.2)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =0.15.0, =1.142.0, =0.1.5, =40.1.0, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70606 Source advisory: SNYK:JS-ELECTRON-18563352...