Is CVE-2026-70608 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70608 being exploited in the wild.

How severe is CVE-2026-70608?

High severity, with a CVSS score of 7.2, published 5 August 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=42.0.0-alpha.1,fixed=42.0.1.

Is there a fix for CVE-2026-70608?

Yes. electron (npm): upgrade to 42.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70608 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-70608?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70608: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.

CVE-2026-70608 · Severity: high · CVSS 7.2 · Published 2026-08-05

Electron is a framework used to build desktop applications using web technologies. A vulnerability exists where untrusted content loaded in a restricted 'sandbox' could bypass security settings to open unauthorized new windows without any user interaction. This could allow malicious content to perform phishing attacks or interact with other parts of the application that were intended to be isolated.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-70608 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70608 being exploited in the wild.
How severe is CVE-2026-70608?: High severity, with a CVSS score of 7.2, published 5 August 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=42.0.0-alpha.1,fixed=42.0.1.
Is there a fix for CVE-2026-70608?: Yes. electron (npm): upgrade to 42.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70608 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-70608?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 42.0.1 or later
```
npm install electron@42.0.1
```

Technical details

A protection mechanism failure (CWE-693) exists in Electron where sandboxed iframes lacking the 'allow-popups' attribute can still trigger new window creation. This occurs because navigations following the OpenURL path fail to check and apply the iframe's sandbox popup restrictions. An attacker providing untrusted content to be rendered in a sandboxed iframe can exploit this to open new windows or trigger 'setWindowOpenHandler' without user interaction. The issue is fixed in versions 39.8.10, 41.10.3, and 42.0.1. Developers can also mitigate this by explicitly denying untrusted window creation requests in 'setWindowOpenHandler'.

Affected products

Electron Electron < 39.8.10, >= 40.0.0-alpha.1, < 41.10.3, >= 42.0.0-alpha.1, < 42.0.1

Identifiers

CVE-2026-70608
GHSA-9f4c-93c8-jc8g

Timeline

2026-07-27: disclosed: Initial disclosure by MarshallOfSound
2026-08-05: advisory: GitHub Advisory published
2026-08-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.