CVE-2026-70610
Received Received - Intake

Prototype Pollution in Electron Framework

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70610
EUVD
EUVD-2026-53543

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.9 (exc)
electron electron to 40.9.2 (exc)
electron electron to 41.2.2 (exc)
electron electron to 42.0.0-beta.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a prototype-pollution issue in Electron's contextBridge API. Objects copied from untrusted content to trusted preload code could carry a malicious prototype, allowing attackers to manipulate object properties even when context isolation is enabled. The issue occurs because the original implementation used Set to copy properties, which could trigger Object.prototype.__proto__ setters when the key was __proto__. The fix replaces Set with CreateDataProperty to treat __proto__ as a regular property.

Detection Guidance

This vulnerability requires checking if your Electron app uses contextBridge with untrusted content and validates object arguments. Review preload scripts for object property access without own-property checks. No direct network detection commands are provided in the resources.

Impact Analysis

If you use an affected Electron version and your app's preload code accepts object arguments from untrusted content without validating them, attackers could modify object properties in your application. This could lead to unintended behavior, data leaks, or even code execution in your app. The attack requires no special privileges or user interaction.

Compliance Impact

The vulnerability could potentially impact compliance with GDPR and HIPAA if exploited to access or modify sensitive data in Electron-based applications. Prototype pollution may lead to unauthorized data exposure or manipulation, violating confidentiality requirements in these regulations. However, the impact depends on whether the affected Electron app handles regulated data and meets specific security controls.

Mitigation Strategies

Update Electron to version 39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.4 or later. Review preload code to ensure it validates object arguments from untrusted content and uses own-property checks before reading properties.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart