CVE-2026-70606
Received Received - Intake

Protocol Handler Session Isolation Bypass in Electron

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70606
EUVD
EUVD-2026-53445

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
electron electron to 40.10.6 (exc)
electron electron to 41.9.1 (exc)
electron electron to 42.5.1 (exc)
electron electron to 43.0.0 (exc)
electron electron to 40.10.6|end_excluding=41.9.1|end_excluding=42.5.1|end_excluding=43.0.0 (exc)
electron electron From 40.0.0-alpha.1|end_excluding=42.5.0 (inc)
electron electron From 41.0.0-alpha.1|end_excluding=41.9.0 (inc)
electron electron From 42.0.0-alpha.1|end_excluding=42.5.0 (inc)
electron electron From 43.0.0-alpha.1|end_excluding=43.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Electron applications using custom protocol handlers. When a handler returns a ProtocolResponse with a URL but no session, Electron incorrectly uses the default session cache instead of the intended session. This allows cached responses to be shared across isolated sessions, potentially exposing data between them.

Detection Guidance

To detect this vulnerability, check if your Electron app uses ProtocolResponse.url without explicitly setting ProtocolResponse.session. Review application code for custom protocol handlers that return a URL without a session. Use Electron version checks to identify affected versions (40.0.0-alpha.1 to 42.5.0, 41.0.0-alpha.1 to 41.9.0, 42.0.0-alpha.1 to 42.5.0, and 43.0.0-alpha.1 and earlier).

Commands to check Electron version: node -e "require('electron/package.json').version"

Impact Analysis

If you use an affected Electron app that relies on separate sessions for isolation, this flaw could let unauthorized users access cached data from other sessions. Attackers might exploit it to retrieve sensitive information shared between otherwise isolated partitions.

Compliance Impact

This vulnerability could lead to unauthorized data exposure between sessions, violating principles of data isolation required by GDPR and HIPAA. Apps handling sensitive data must ensure session isolation to maintain compliance.

Mitigation Strategies

Immediately update Electron to a patched version (40.10.6, 41.9.1, 42.5.1, or 43.0.0 or later). If updating is not possible, explicitly set ProtocolResponse.session in custom protocol handlers to ensure requests use the intended session's cache.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70606. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart