CVE-2026-70599
Received Received - Intake

Origin Validation Bypass in Electron Framework

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70599
EUVD
EUVD-2026-53428

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
electron electron 39.8.7
electron electron 40.9.0
electron electron 41.2.0
electron electron 42.0.0-beta.1
electron electron to 39.8.7 (exc)
electron electron to 40.9.0 (exc)
electron electron to 41.2.0 (exc)
electron electron to 42.0.0-beta.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Electron allows cross-origin iframes to gain unauthorized device access by exploiting incorrect permission checks. When an iframe requests device permissions like serial-port, camera, or microphone, the system checks the top-level frame's origin instead of the iframe's origin. This lets malicious iframes bypass intended restrictions and access devices meant for the main application.

Detection Guidance

To detect this vulnerability, check your Electron application version against the fixed versions (39.8.7, 40.9.0, 41.2.0, or 42.0.0-beta.1). Use commands like 'electron --version' or inspect package.json for version details. If using a framework like Electron Builder, check the Electron dependency version in your project files.

Impact Analysis

If you use an affected Electron version in an app with cross-origin iframes and device permissions, a malicious iframe could secretly access your camera, microphone, or serial ports without permission. This could lead to privacy breaches, data theft, or unauthorized device control. Users might unknowingly expose sensitive information.

Compliance Impact

This vulnerability could violate GDPR's data protection principles by enabling unauthorized access to personal data via camera or microphone. For HIPAA, it risks exposing protected health information if medical apps are compromised. Organizations may face compliance failures, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update Electron to version 39.8.7, 40.9.0, 41.2.0, or 42.0.0-beta.1 or later. If updating is not possible, avoid delegating device permissions to untrusted cross-origin iframes. Modify permission check handlers to use details.securityOrigin instead of requestingOrigin for validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70599. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart