CVE-2026-70601
Received Received - Intake

Context Isolation Bypass in Electron Framework

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70601
EUVD
EUVD-2026-53433

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.9 (exc)
electron electron to 40.9.2 (exc)
electron electron to 41.2.2 (exc)
electron electron to 42.0.0-beta.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a context isolation bypass in Electron, a framework for building desktop apps. It affects versions before 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5. Apps exposing Promise-returning functions via contextBridge to untrusted web content may allow access to the isolated preload world, potentially leading to Node.js access if sandboxing is disabled or nodeIntegration is enabled.

Detection Guidance

To detect this vulnerability, check if your Electron app exposes Promise-returning functions via contextBridge to untrusted web content. Review the app's preload scripts for contextBridge.exposeInMainWorld calls with async functions. Verify Electron version against patched releases (39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5).

Impact Analysis

Untrusted web content could gain access to sensitive capabilities of the preload script, including Node.js access in renderers without sandboxing or with nodeIntegration enabled. This could lead to data theft, code execution, or further system compromise depending on the app's permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Electron versions may face compliance violations if user data is exposed due to the context isolation bypass.

Mitigation Strategies

Immediately update Electron to a patched version (39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.5). If updating isn't possible, disable contextBridge usage for untrusted content or ensure renderers have sandboxing enabled and nodeIntegration disabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart