Executive brief
Electron-based applications that expose certain functions to web content are vulnerable to a security bypass. This allows untrusted websites loaded within the app to break out of their restricted environment and gain the full privileges of the application's internal scripts. In some configurations, this can lead to full control over the underlying computer system.
Technical details
A protection mechanism failure (CWE-693) in Electron's contextBridge allows for a context isolation bypass. By hijacking 'Function.prototype.bind', untrusted web content can gain access to the isolated preload world. This exploit is possible when an application exposes Promise-returning functions (commonly used for ipcRenderer.invoke) to untrusted content. If the renderer is un-sandboxed or has 'nodeIntegration' enabled, the attacker can escalate this access to execute arbitrary Node.js commands. Patches are available in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.
Affected products
- Electron Electron < 39.8.9, >= 40.0.0-alpha.1 < 40.9.2, >= 41.0.0-alpha.1 < 41.2.2, >= 42.0.0-alpha.1 < 42.0.0-beta.5
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory