# CVE-2026-70599: Electron origin validation error in permission check handler

Source: https://junglewise.ai/threats/cve-2026-70599-electron-origin-validation-error-in-permission-check-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-08-05  
License: CC BY 4.0 with a link back

CVE-2026-70599 · Severity: medium · CVSS 5.9 · Published 2026-08-05

Electron, a framework used to build desktop applications, contains a flaw in how it handles security permissions for embedded web content. An attacker could potentially bypass security checks to access sensitive hardware like cameras, microphones, or serial ports by tricking the system into thinking the request came from a trusted main window rather than an untrusted sub-frame. This could lead to unauthorized surveillance or data access if an application embeds untrusted third-party content.

Technologies: [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-70599 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70599 being exploited in the wild.

**How severe is CVE-2026-70599?** Medium severity, with a CVSS score of 5.9, published 5 August 2026.

**Which products and versions are affected?** electron (npm) SEMVER:introduced=0,fixed=39.8.7.

**Is there a fix for CVE-2026-70599?** Yes. electron (npm): upgrade to 39.8.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70599 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-70599?** Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 39.8.7 or later

  ```sh
  npm install electron@39.8.7
  ```


## Technical details

An origin validation error (CWE-346) exists in Electron's `session.setPermissionCheckHandler`. When an iframe requests access to media devices (camera/microphone) or serial ports, the `requestingOrigin` parameter incorrectly reflects the origin of the top-level frame instead of the actual requesting iframe. This allows a cross-origin iframe to inherit permissions intended only for the main application window if the developer's handler logic relies solely on `requestingOrigin`. The vulnerability is exploitable if an application embeds untrusted iframes and uses origin-based logic in its permission handler. Developers are advised to upgrade to patched versions or use `details.securityOrigin` as a workaround.

## Affected products

- Electron Electron < 39.8.7, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.2.0, >= 42.0.0-alpha.1 < 42.0.0-beta.1

## Identifiers

- CVE-2026-70599
- GHSA-9pf5-hg6p-4pwp

## Timeline

- 2026-07-27: disclosed
- 2026-08-05: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)