Is CVE-2026-70612 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70612 being exploited in the wild.

How severe is CVE-2026-70612?

Medium severity, with a CVSS score of 5.4, published 5 August 2026.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=39.8.8.

Is there a fix for CVE-2026-70612?

Yes. electron (npm): upgrade to 39.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-70612 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-70612?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70612: Electron sandbox bypass via external protocol handlers in iframes

CVE-2026-70612 · Severity: medium · CVSS 5.4 · Published 2026-08-05

Electron, a framework used to build desktop applications like Slack and Discord, contained a flaw where restricted web content could bypass security boundaries. Specifically, a sandboxed iframe—a component meant to isolate untrusted content—could force the user's computer to launch external applications via custom web links. This could allow malicious content to interact with other software installed on the user's system, potentially leading to unauthorized actions or data exposure.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-70612 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70612 being exploited in the wild.
How severe is CVE-2026-70612?: Medium severity, with a CVSS score of 5.4, published 5 August 2026.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=39.8.8.
Is there a fix for CVE-2026-70612?: Yes. electron (npm): upgrade to 39.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70612 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-70612?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 39.8.8 or later
```
npm install electron@39.8.8
```

Technical details

A vulnerability in Electron's navigation handling allowed sandboxed iframes to bypass security restrictions and trigger external protocol handlers. The root cause was that requests to open external protocol URLs did not account for the iframe's sandbox flags, and the sandbox state was not passed to the application's permission handlers. An attacker providing untrusted content within a sandboxed iframe could exploit this to launch OS-registered applications if the 'openExternal' permission was granted (which is the default behavior). The issue has been resolved by ensuring iframe sandbox flags are respected during external protocol navigation. Fixes are available in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

Affected products

Electron Electron < 39.8.8, >= 40.0.0-alpha.1, < 40.9.0, >= 41.0.0-alpha.1, < 41.2.1, >= 42.0.0-alpha.1, < 42.0.0-beta.3

Identifiers

CVE-2026-70612
GHSA-p2rr-rvmm-c5fp

Timeline

2026-04-12: patched: Fixes merged into various release branches.
2026-07-27: disclosed: Initial advisory publication.
2026-08-05: advisory: Advisory updated and published to GitHub Advisory Database.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.