Junglewise Threat Intelligence

CVE-2026-70609: Electron JavaScript injection in DevTools via unsanitized dock state

CVE-2026-70609 · Severity: medium · CVSS 5.7 · Published 2026-08-05

Executive brief

Electron's Developer Tools feature did not properly validate user-supplied configuration values before executing them as JavaScript code. An attacker who can influence the DevTools mode setting (such as via an embedded webview) can inject and execute arbitrary JavaScript in the DevTools context, potentially gaining access to Node.js APIs in unsandboxed applications. This could lead to complete application compromise including data theft or malicious code execution.

Technical details

The vulnerability exists in the `webContents.openDevTools()` method, where the `mode` parameter (dock state) was concatenated directly into a JavaScript string and executed via `ExecuteJavaScript()` without sanitization or validation. The vulnerable code in `shell/browser/ui/inspectable_web_contents.cc` failed to validate the dock_state_ member against known valid values (`right`, `bottom`, `undocked`, `detach`) before injection. An attacker can exploit this if untrusted input reaches the mode argument of `openDevTools()` or if untrusted content can call the method on an embedded `<webview>` element. In unsandboxed configurations, successful exploitation grants access to Node.js APIs, allowing arbitrary code execution. The fix validates the dock state against an allowlist and falls back to a safe default ("right") for unrecognized values. Patches are available in versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1 and later.

Affected products

  • Electron Electron < 39.8.7, >= 40.0.0-alpha.1 and < 40.9.0, >= 41.0.0-alpha.1 and < 41.2.0, >= 42.0.0-alpha.1 and < 42.0.0-beta.1

Timeline

  • 2026-08-05: disclosed: Vulnerability published in GitHub Advisory Database
  • 2026-08-05: patched: Fixed versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1 released

References