CVE-2026-70602
Received Received - Intake

Session Isolation Bypass in Electron Framework

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70602
EUVD
EUVD-2026-53435

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.8 (exc)
electron electron to 40.9.0 (exc)
electron electron to 41.2.1 (exc)
electron electron to 42.0.0-beta.3 (exc)
electron electron to 39.8.8|end_excluding=40.9.0|end_excluding=41.2.1|end_excluding=42.0.0-beta.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Electron, a framework for building cross-platform desktop apps. It allows a malicious or compromised extension to access and interact with windows from different sessions, bypassing intended isolation. This happens because extension APIs were not properly scoped to their own sessions before versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

Detection Guidance

Detection requires checking Electron versions. Run 'electron --version' in terminal. If version is below 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3, the system is vulnerable. Also inspect extensions loaded via session.loadExtension for suspicious activity.

Impact Analysis

If you use Electron apps that load Chrome extensions via session.loadExtension and rely on separate sessions for isolation, this flaw could let an extension access sensitive data or perform actions in other sessions. This might lead to data leaks or unauthorized actions in affected apps.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health data privacy) if exploited. Apps handling regulated data must ensure proper session isolation to maintain compliance.

Mitigation Strategies

Update Electron to versions 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3 or later. Remove or disable untrusted extensions. Ensure extensions are loaded only in isolated sessions. Monitor for unauthorized navigation or scripting activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart