Is CVE-2026-70601 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70601 being exploited in the wild.

How severe is CVE-2026-70601?

High severity, with a CVSS score of 7.5, published 5 August 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=39.8.9.

Is there a fix for CVE-2026-70601?

Yes. electron (npm): upgrade to 39.8.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70601 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-70601?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70601: Electron context isolation bypass via Function.prototype.bind hijack

CVE-2026-70601 · Severity: high · CVSS 7.5 · Published 2026-08-05

Electron-based applications that expose certain functions to web content are vulnerable to a security bypass. This allows untrusted websites loaded within the app to break out of their restricted environment and gain the full privileges of the application's internal scripts. In some configurations, this can lead to full control over the underlying computer system.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-70601 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70601 being exploited in the wild.
How severe is CVE-2026-70601?: High severity, with a CVSS score of 7.5, published 5 August 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=39.8.9.
Is there a fix for CVE-2026-70601?: Yes. electron (npm): upgrade to 39.8.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70601 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-70601?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.9 or later
```
npm install electron@39.8.9
```

Technical details

A protection mechanism failure (CWE-693) in Electron's contextBridge allows for a context isolation bypass. By hijacking 'Function.prototype.bind', untrusted web content can gain access to the isolated preload world. This exploit is possible when an application exposes Promise-returning functions (commonly used for ipcRenderer.invoke) to untrusted content. If the renderer is un-sandboxed or has 'nodeIntegration' enabled, the attacker can escalate this access to execute arbitrary Node.js commands. Patches are available in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.

Affected products

Electron Electron < 39.8.9, >= 40.0.0-alpha.1 < 40.9.2, >= 41.0.0-alpha.1 < 41.2.2, >= 42.0.0-alpha.1 < 42.0.0-beta.5

Identifiers

CVE-2026-70601
GHSA-h7rp-cf8h-j98x

Timeline

2026-07-27: disclosed
2026-08-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.