Exposure of Data Element to Wrong Session

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the extension tab and scripting APIs not being properly scoped to the...

Exposure of Data Element to Wrong Session

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the extension tab and scripting APIs not being properly scope...

CVE-2026-70602 Electron: Extension tab APIs operate across session boundaries

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...

EUVD-2026-53435

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...

CVE-2026-70602

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...

CVE-2026-70602 Electron: Extension tab APIs operate across session boundaries

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session...

GHSA-H7RP-CF8H-J98X Electron: Context isolation bypass via Function.prototype.bind hijack

Impact Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, o...

Electron: Context isolation bypass via Function.prototype.bind hijack

Impact Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, o...

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

EUVD-2026-53433

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601

CVE-2026-70601 affects Electron, a framework for building cross‑platform desktop apps with JavaScript/HTML/CSS. The issue arises when apps expose Promise‑returning functions to web content via contextBridge, allowing a context isolation bypass. In environments where a sandbox is absent or nodeInt...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

vpod v0.6.0

Vpod Getting Started • Documentation • Issues • Contributing What is a vpod ? A vpod is a lightweight, portable sandbox that gives an untrusted process an instant Linux environment. It uses a RISC‑V architecture and runs entirely inside WebAssembly. Fast startup : Boot in under a second. Portable...

BrowserBox v18.4.0

BrowserBox by DOSAYGO Secure, modern Remote Browser Isolation RBI with a clientless experience 🔐 NEW in v18.0.1 — Passkey authentication on macOS: sign in to websites with real passkeys inside your remote browser. Passkeys are created and stored on your Mac's Secure Enclave and unlocked with Touc...

CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

EUVD-2026-53194

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and $user-hasCompany$model-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...