Junglewise Threat Intelligence

CVE-2026-70607: Electron improper input validation in window.open features string

CVE-2026-70607 · Severity: medium · CVSS 5.3 · Published 2026-08-05

Executive brief

Electron, a framework used to build desktop applications with web technologies, contains a vulnerability where untrusted web content can manipulate window settings. By using specific commands when opening a new window, an attacker could force the application to access unauthorized files or network locations. This could lead to the exposure of sensitive local data or internal network information.

Technical details

A vulnerability in Electron's handling of the window.open() features string allows untrusted web content to specify privileged BrowserWindow options that are not properly allowlisted. By crafting a specific features string, an attacker can bypass intended restrictions and set options that cause the main process to access attacker-controlled file or network paths. This is classified as improper input validation (CWE-20). The vulnerability affects applications that allow untrusted content to call window.open() without implementing a setWindowOpenHandler to deny or override child window options. Patches have been released in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

Affected products

  • Electron Electron < 39.8.8, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.2.1, >= 42.0.0-alpha.1 < 42.0.0-beta.3

Timeline

  • 2026-04-11: patched: Initial backport PRs merged into various release branches.
  • 2026-07-27: disclosed: Advisory published by Electron maintainers.
  • 2026-08-05: advisory: GitHub Advisory reviewed and updated.

References