# CVE-2026-70608: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.

Source: https://junglewise.ai/threats/cve-2026-70608-electron-sandbox-bypass-via-openurl-navigation-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-08-05  
License: CC BY 4.0 with a link back

CVE-2026-70608 · Severity: high · CVSS 7.2 · Published 2026-08-05

Electron is a framework used to build desktop applications using web technologies. A vulnerability exists where untrusted content loaded in a restricted 'sandbox' could bypass security settings to open unauthorized new windows without any user interaction. This could allow malicious content to perform phishing attacks or interact with other parts of the application that were intended to be isolated.

Technologies: [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-70608 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70608 being exploited in the wild.

**How severe is CVE-2026-70608?** High severity, with a CVSS score of 7.2, published 5 August 2026.

**Which products and versions are affected?** electron (npm) SEMVER:introduced=42.0.0-alpha.1,fixed=42.0.1.

**Is there a fix for CVE-2026-70608?** Yes. electron (npm): upgrade to 42.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70608 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-70608?** Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 42.0.1 or later

  ```sh
  npm install electron@42.0.1
  ```


## Technical details

A protection mechanism failure (CWE-693) exists in Electron where sandboxed iframes lacking the 'allow-popups' attribute can still trigger new window creation. This occurs because navigations following the OpenURL path fail to check and apply the iframe's sandbox popup restrictions. An attacker providing untrusted content to be rendered in a sandboxed iframe can exploit this to open new windows or trigger 'setWindowOpenHandler' without user interaction. The issue is fixed in versions 39.8.10, 41.10.3, and 42.0.1. Developers can also mitigate this by explicitly denying untrusted window creation requests in 'setWindowOpenHandler'.

## Affected products

- Electron Electron < 39.8.10, >= 40.0.0-alpha.1, < 41.10.3, >= 42.0.0-alpha.1, < 42.0.1

## Identifiers

- CVE-2026-70608
- GHSA-9f4c-93c8-jc8g

## Timeline

- 2026-07-27: disclosed: Initial disclosure by MarshallOfSound
- 2026-08-05: advisory: GitHub Advisory published
- 2026-08-05: patched

## References

- [https://api.github.com/users/Ciarands](https://api.github.com/users/Ciarands)
- [https://github.com/Ciarands](https://github.com/Ciarands)
- [https://api.github.com/users/Ciarands/gists%7B/gist_id%7D](https://api.github.com/users/Ciarands/gists%7B/gist_id%7D)
- [https://api.github.com/users/Ciarands/repos](https://api.github.com/users/Ciarands/repos)
- [https://avatars.githubusercontent.com/u/74070993?v=4](https://avatars.githubusercontent.com/u/74070993?v=4)
- [https://api.github.com/users/Ciarands/events%7B/privacy%7D](https://api.github.com/users/Ciarands/events%7B/privacy%7D)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)