CVE-2026-70609
Received Received - Intake

Privilege Escalation in Electron via DevTools Mode

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70609
EUVD
EUVD-2026-53566

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.7 (exc)
electron electron to 40.9.0 (exc)
electron electron to 41.2.0 (exc)
electron electron to 42.0.0-beta.1 (exc)
electron electron to 39.8.7 (inc)
electron electron to 40.9.0 (inc)
electron electron to 41.2.0 (inc)
electron electron to 42.0.0-beta.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Electron, a framework for building desktop apps with JavaScript, HTML, and CSS. It involves improper sanitization of the mode option in webContents.openDevTools(). If exploited, an attacker could run malicious scripts in the DevTools context, gaining access to Node.js capabilities, especially in unsandboxed environments.

Detection Guidance

Detection involves checking Electron versions against fixed releases. Use commands like 'electron --version' or inspect package.json for Electron dependencies. Compare versions against 39.8.7, 40.9.0, 41.2.0, or 42.0.0-beta.1.

Impact Analysis

An attacker could execute arbitrary code on your system if they trick you into opening DevTools with a malicious mode value. This could lead to data theft, system compromise, or further malware installation, depending on your system's configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected Electron versions may face compliance breaches if exploited.

Mitigation Strategies

Upgrade Electron to the latest patched versions (39.8.7, 40.9.0, 41.2.0, or 42.0.0-beta.1). Review applications using Electron to ensure they use updated versions. Avoid passing untrusted input to openDevTools().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart