CVE-2026-70607

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

• CWE-20

• https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a
• https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7
• https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b
• https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55
• https://github.com/electron/electron/pull/50946
• https://github.com/electron/electron/pull/50947
• https://github.com/electron/electron/pull/50948
• https://github.com/electron/electron/pull/50949
• https://github.com/electron/electron/releases/tag/v39.8.8
• https://github.com/electron/electron/releases/tag/v40.9.0
• https://github.com/electron/electron/releases/tag/v41.2.1
• https://github.com/electron/electron/releases/tag/v42.0.0-beta.3
• https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj

Published

Aug 5, 2026

Last Modified

Aug 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70601Electron is a framework for writing cross-platform desktop a…7.5
• CVE-2026-70602Electron is a framework for writing cross-platform desktop a…6.6
• CVE-2026-70603Electron is a framework for writing cross-platform desktop a…6
• CVE-2026-70604Electron is a framework for writing cross-platform desktop a…7.4
• CVE-2026-70605Electron is a framework for writing cross-platform desktop a…5.9
• CVE-2026-70606Electron is a framework for writing cross-platform desktop a…5.9
• CVE-2026-70608Electron is a framework for writing cross-platform desktop a…7.2
• CVE-2026-70609Electron is a framework for writing cross-platform desktop a…5.7
• CVE-2026-7061A weakness has been identified in Toowiredd chatgpt-mcp-serv…7.3
• CVE-2026-70610Electron is a framework for writing cross-platform desktop a…5.4
• CVE-2026-70611Electron is a framework for writing cross-platform desktop a…6.9
• CVE-2026-70612Electron is a framework for writing cross-platform desktop a…5.4