CVE-2026-70599 json
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
published 3mo ago modified last mo. also EUVD-2026-53428 , GHSA-9pf5-hg6p-4pwp
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
Patch / fix
- npm electron 39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1
- atom electron 39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1
- electronjs electron 39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1
Is CVE-2026-70599 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3mo ago
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | electron | <39.8.7 >=40.0.0-alpha.1, <40.9.0 >=41.0.0-alpha.1, <41.2.0 >=42.0.0-alpha.1, <42.0.0-beta.1 |
39.8.7 40.9.0 41.2.0 42.0.0-beta.1 |
Affected products
- electron electron
Classification
- Weakness
-
- CWE-346 Origin Validation Error
References
-
github.com
/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c
web, patch
-
github.com
/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp
web, vendor-advisory, advisory
-
github.com
/electron/electron
package
Sources
- CVE List CVE-2026-70599
- GitHub Advisory GHSA-9pf5-hg6p-4pwp
- NVD CVE-2026-70599
- Maintainer advisory GHSA-9pf5-hg6p-4pwp
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of electron/electron published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.