Is CVE-2026-70599 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70599 being exploited in the wild.

How severe is CVE-2026-70599?

Medium severity, with a CVSS score of 5.9, published 5 August 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=39.8.7.

Is there a fix for CVE-2026-70599?

Yes. electron (npm): upgrade to 39.8.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70599 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-70599?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70599: Electron origin validation error in permission check handler

CVE-2026-70599 · Severity: medium · CVSS 5.9 · Published 2026-08-05

Electron, a framework used to build desktop applications, contains a flaw in how it handles security permissions for embedded web content. An attacker could potentially bypass security checks to access sensitive hardware like cameras, microphones, or serial ports by tricking the system into thinking the request came from a trusted main window rather than an untrusted sub-frame. This could lead to unauthorized surveillance or data access if an application embeds untrusted third-party content.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-70599 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70599 being exploited in the wild.
How severe is CVE-2026-70599?: Medium severity, with a CVSS score of 5.9, published 5 August 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=39.8.7.
Is there a fix for CVE-2026-70599?: Yes. electron (npm): upgrade to 39.8.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70599 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-70599?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.7 or later
```
npm install electron@39.8.7
```

Technical details

An origin validation error (CWE-346) exists in Electron's `session.setPermissionCheckHandler`. When an iframe requests access to media devices (camera/microphone) or serial ports, the `requestingOrigin` parameter incorrectly reflects the origin of the top-level frame instead of the actual requesting iframe. This allows a cross-origin iframe to inherit permissions intended only for the main application window if the developer's handler logic relies solely on `requestingOrigin`. The vulnerability is exploitable if an application embeds untrusted iframes and uses origin-based logic in its permission handler. Developers are advised to upgrade to patched versions or use `details.securityOrigin` as a workaround.

Affected products

Electron Electron < 39.8.7, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.2.0, >= 42.0.0-alpha.1 < 42.0.0-beta.1

Identifiers

CVE-2026-70599
GHSA-9pf5-hg6p-4pwp

Timeline

2026-07-27: disclosed
2026-08-05: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.