Is CVE-2026-70609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70609 being exploited in the wild.

How severe is CVE-2026-70609?

Medium severity, with a CVSS score of 5.7, published 5 August 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=39.8.7.

Is there a fix for CVE-2026-70609?

Yes. electron (npm): upgrade to 39.8.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70609 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-70609?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70609: Electron JavaScript injection in DevTools via unsanitized dock state

CVE-2026-70609 · Severity: medium · CVSS 5.7 · Published 2026-08-05

Electron's Developer Tools feature did not properly validate user-supplied configuration values before executing them as JavaScript code. An attacker who can influence the DevTools mode setting (such as via an embedded webview) can inject and execute arbitrary JavaScript in the DevTools context, potentially gaining access to Node.js APIs in unsandboxed applications. This could lead to complete application compromise including data theft or malicious code execution.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-70609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70609 being exploited in the wild.
How severe is CVE-2026-70609?: Medium severity, with a CVSS score of 5.7, published 5 August 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=39.8.7.
Is there a fix for CVE-2026-70609?: Yes. electron (npm): upgrade to 39.8.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70609 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-70609?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.7 or later
```
npm install electron@39.8.7
```

Technical details

The vulnerability exists in the `webContents.openDevTools()` method, where the `mode` parameter (dock state) was concatenated directly into a JavaScript string and executed via `ExecuteJavaScript()` without sanitization or validation. The vulnerable code in `shell/browser/ui/inspectable_web_contents.cc` failed to validate the dock_state_ member against known valid values (`right`, `bottom`, `undocked`, `detach`) before injection. An attacker can exploit this if untrusted input reaches the mode argument of `openDevTools()` or if untrusted content can call the method on an embedded `<webview>` element. In unsandboxed configurations, successful exploitation grants access to Node.js APIs, allowing arbitrary code execution. The fix validates the dock state against an allowlist and falls back to a safe default ("right") for unrecognized values. Patches are available in versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1 and later.

Affected products

Electron Electron < 39.8.7, >= 40.0.0-alpha.1 and < 40.9.0, >= 41.0.0-alpha.1 and < 41.2.0, >= 42.0.0-alpha.1 and < 42.0.0-beta.1

Identifiers

CVE-2026-70609
GHSA-4f78-qhmw-8j8m

Timeline

2026-08-05: disclosed: Vulnerability published in GitHub Advisory Database
2026-08-05: patched: Fixed versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.