CVE-2026-70609

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

• CWE-94
• CWE-116

• https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1
• https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b
• https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce
• https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba
• https://github.com/electron/electron/pull/50665
• https://github.com/electron/electron/pull/50666
• https://github.com/electron/electron/pull/50667
• https://github.com/electron/electron/pull/50668
• https://github.com/electron/electron/releases/tag/v39.8.7
• https://github.com/electron/electron/releases/tag/v40.9.0
• https://github.com/electron/electron/releases/tag/v41.2.0
• https://github.com/electron/electron/releases/tag/v42.0.0-beta.1
• https://github.com/electron/electron/security/advisories/GHSA-4f78-qhmw-8j8m

Published

Aug 5, 2026

Last Modified

Aug 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70603Electron is a framework for writing cross-platform desktop a…6
• CVE-2026-70604Electron is a framework for writing cross-platform desktop a…7.4
• CVE-2026-70605Electron is a framework for writing cross-platform desktop a…5.9
• CVE-2026-70606Electron is a framework for writing cross-platform desktop a…5.9
• CVE-2026-70607Electron is a framework for writing cross-platform desktop a…5.3
• CVE-2026-70608Electron is a framework for writing cross-platform desktop a…7.2
• CVE-2026-7061A weakness has been identified in Toowiredd chatgpt-mcp-serv…7.3
• CVE-2026-70610Electron is a framework for writing cross-platform desktop a…5.4
• CVE-2026-70611Electron is a framework for writing cross-platform desktop a…6.9
• CVE-2026-70612Electron is a framework for writing cross-platform desktop a…5.4
• CVE-2026-70615boringproxy through 0.10.0 contains a newline injection vuln…9.9
• CVE-2026-70616boringproxy through 0.10.0 contains a resource exhaustion vu…7.1