FKIE_CVE-2026-70607

Vulnerability from fkie_nvd - Published: 2026-08-05 17:16 - Updated: 2026-08-05 19:17
Severity
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
References
security-advisories@github.comhttps://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a
security-advisories@github.comhttps://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7
security-advisories@github.comhttps://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b
security-advisories@github.comhttps://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55
security-advisories@github.comhttps://github.com/electron/electron/pull/50946
security-advisories@github.comhttps://github.com/electron/electron/pull/50947
security-advisories@github.comhttps://github.com/electron/electron/pull/50948
security-advisories@github.comhttps://github.com/electron/electron/pull/50949
security-advisories@github.comhttps://github.com/electron/electron/releases/tag/v39.8.8
security-advisories@github.comhttps://github.com/electron/electron/releases/tag/v40.9.0
security-advisories@github.comhttps://github.com/electron/electron/releases/tag/v41.2.1
security-advisories@github.comhttps://github.com/electron/electron/releases/tag/v42.0.0-beta.3
security-advisories@github.comhttps://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 39.8.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 40.0.0-alpha.1, \u003c 40.9.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 41.0.0-alpha.1, \u003c 41.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-beta.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3."
    }
  ],
  "id": "CVE-2026-70607",
  "lastModified": "2026-08-05T19:17:39.990",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-70607",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-05T18:27:03.596456Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-05T17:16:54.687",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/pull/50946"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/pull/50947"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/pull/50948"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/pull/50949"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/releases/tag/v39.8.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/releases/tag/v40.9.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/releases/tag/v41.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.