CVE-2026-70600
Received Received - Intake

Clickjacking via Cross-Origin Autofill Popup in Electron

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70600
EUVD
EUVD-2026-53432

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.8 (exc)
electron electron to 40.9.0 (exc)
electron electron to 41.2.1 (exc)
electron electron to 42.0.0-beta.3 (exc)
electron electron From 42.0.0-alpha.1 (inc) to 42.0.0-beta.3 (exc)
electron electron From 40.0.0-alpha.1 (inc) to 40.9.0 (exc)
electron electron From 41.0.0-alpha.1 (inc) to 41.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1021 The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Electron allows a cross-origin iframe to position its native autofill popup outside its own bounds and over the embedding page's UI. This could enable clickjacking or spoofing of trusted UI elements.

Detection Guidance

Detection involves checking Electron versions against patched releases. Use commands like 'electron --version' or inspect package.json for Electron dependencies. Compare versions against 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3.

Impact Analysis

If you use an affected Electron version and embed untrusted content in iframes alongside trusted UI, attackers could trick users into clicking on hidden elements or fake UI components. This could lead to unintended actions or data exposure.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling clickjacking or UI spoofing attacks. If an application embeds untrusted content in iframes, attackers might trick users into interacting with malicious elements disguised as trusted UI, which could lead to unauthorized data access or disclosure. This risk is higher in applications handling sensitive data, such as personal or health information.

Mitigation Strategies

Upgrade Electron to versions 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3. If embedding untrusted content in iframes, ensure trusted UI is not obscured. Review iframe usage in applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart