# CVE-2026-70600: Electron UI layer restriction bypass in native autofill popup

Source: https://junglewise.ai/threats/cve-2026-70600-electron-ui-layer-restriction-bypass-in-native-autofill-popup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-08-05  
License: CC BY 4.0 with a link back

CVE-2026-70600 · Severity: low · CVSS 3.1 · Published 2026-08-05

Electron, a framework used to build desktop applications, is vulnerable to a user interface flaw where untrusted content can manipulate native popups. An attacker could position an autofill popup over legitimate parts of the application's interface, potentially tricking users into clicking something they did not intend to or spoofing trusted information. This issue only affects applications that embed untrusted third-party content within the same window as sensitive or trusted user interface elements.

Technologies: [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-70600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70600 being exploited in the wild.

**How severe is CVE-2026-70600?** Low severity, with a CVSS score of 3.1, published 5 August 2026.

**Which products and versions are affected?** electron (npm) SEMVER:introduced=0,fixed=39.8.8.

**Is there a fix for CVE-2026-70600?** Yes. electron (npm): upgrade to 39.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70600 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-70600?** Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 39.8.8 or later

  ```sh
  npm install electron@39.8.8
  ```


## Technical details

A vulnerability classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) exists in Electron. The root cause is a failure to restrict the positioning of native autofill popups when triggered by cross-origin iframes. A remote attacker can exploit this by embedding malicious content in an iframe, which then positions the native popup over the parent window's trusted UI. This requires user interaction and is only applicable to apps that mix untrusted content with trusted UI in the same window. Patches are available in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

## Affected products

- Electron electron < 39.8.8, >= 40.0.0-alpha.1, < 40.9.0, >= 41.0.0-alpha.1, < 41.2.1, >= 42.0.0-alpha.1, < 42.0.0-beta.3

## Identifiers

- CVE-2026-70600
- GHSA-x8rc-wpg4-grpf

## Timeline

- 2026-07-27: disclosed
- 2026-08-05: advisory

## References

- [https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf](https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf)
- [https://api.github.com/repos/electron/electron/security-advisories/GHSA-x8rc-wpg4-grpf](https://api.github.com/repos/electron/electron/security-advisories/GHSA-x8rc-wpg4-grpf)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)