# CVE-2026-70607: Electron improper input validation in window.open features string

Source: https://junglewise.ai/threats/cve-2026-70607-electron-improper-input-validation-in-window-open-features-string  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-08-05  
License: CC BY 4.0 with a link back

CVE-2026-70607 · Severity: medium · CVSS 5.3 · Published 2026-08-05

Electron, a framework used to build desktop applications with web technologies, contains a vulnerability where untrusted web content can manipulate window settings. By using specific commands when opening a new window, an attacker could force the application to access unauthorized files or network locations. This could lead to the exposure of sensitive local data or internal network information.

Technologies: [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-70607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70607 being exploited in the wild.

**How severe is CVE-2026-70607?** Medium severity, with a CVSS score of 5.3, published 5 August 2026.

**Which products and versions are affected?** electron (npm) SEMVER:introduced=0,fixed=39.8.8.

**Is there a fix for CVE-2026-70607?** Yes. electron (npm): upgrade to 39.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70607 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-70607?** Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 39.8.8 or later

  ```sh
  npm install electron@39.8.8
  ```


## Technical details

A vulnerability in Electron's handling of the window.open() features string allows untrusted web content to specify privileged BrowserWindow options that are not properly allowlisted. By crafting a specific features string, an attacker can bypass intended restrictions and set options that cause the main process to access attacker-controlled file or network paths. This is classified as improper input validation (CWE-20). The vulnerability affects applications that allow untrusted content to call window.open() without implementing a setWindowOpenHandler to deny or override child window options. Patches have been released in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

## Affected products

- Electron Electron < 39.8.8, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.2.1, >= 42.0.0-alpha.1 < 42.0.0-beta.3

## Identifiers

- CVE-2026-70607
- GHSA-v93f-fgjr-hjrj

## Timeline

- 2026-04-11: patched: Initial backport PRs merged into various release branches.
- 2026-07-27: disclosed: Advisory published by Electron maintainers.
- 2026-08-05: advisory: GitHub Advisory reviewed and updated.

## References

- [https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj](https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj)
- [https://github.com/electron/electron/pull/50946](https://github.com/electron/electron/pull/50946)
- [https://github.com/electron/electron/pull/50947](https://github.com/electron/electron/pull/50947)
- [https://github.com/electron/electron/pull/50948](https://github.com/electron/electron/pull/50948)
- [https://github.com/electron/electron/pull/50949](https://github.com/electron/electron/pull/50949)
- [https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a](https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)