CVE-2026-70608
Received Received - Intake

Sandboxed iframe Window Creation in Electron

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70608
EUVD
EUVD-2026-53564

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.10 (exc)
electron electron to 41.10.3 (exc)
electron electron to 42.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-1021 The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Electron allows a sandboxed iframe without the allow-popups keyword to open a new window or trigger setWindowOpenHandler without user interaction. The issue occurs because navigations through the OpenURL path did not enforce iframe sandbox popup restrictions. Apps embedding untrusted content in sandboxed iframes and relying on the absence of allow-popups to prevent window creation are affected.

Detection Guidance

To detect this vulnerability, check if your Electron application uses versions prior to 39.8.10, 41.10.3, or 42.0.1. Inspect the application's package.json or runtime version. No specific network commands are required as this is a client-side issue.

Impact Analysis

If you use an affected Electron version and embed untrusted content in sandboxed iframes, this vulnerability could allow that content to open new windows or trigger setWindowOpenHandler without user interaction. This may lead to unauthorized actions, potential phishing, or exposure of sensitive data depending on the app's context.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized window creation from sandboxed iframes. If an application embeds untrusted content in sandboxed iframes and relies on the absence of allow-popups to prevent window creation, this flaw could bypass security controls, potentially leading to data exfiltration or unauthorized access. Compliance may be affected if such unauthorized actions compromise user data privacy or security controls required by these regulations.

Mitigation Strategies
  • Upgrade Electron to version 39.8.10, 41.10.3, or 42.0.1 or later.
  • If upgrading is not possible, implement setWindowOpenHandler to deny window creation for untrusted content.
  • Review sandboxed iframe configurations to ensure allow-popups is explicitly set if needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart