Junglewise Threat Intelligence

CVE-2026-70612: Electron sandbox bypass via external protocol handlers in iframes

CVE-2026-70612 · Severity: medium · CVSS 5.4 · Published 2026-08-05

Executive brief

Electron, a framework used to build desktop applications like Slack and Discord, contained a flaw where restricted web content could bypass security boundaries. Specifically, a sandboxed iframe—a component meant to isolate untrusted content—could force the user's computer to launch external applications via custom web links. This could allow malicious content to interact with other software installed on the user's system, potentially leading to unauthorized actions or data exposure.

Technical details

A vulnerability in Electron's navigation handling allowed sandboxed iframes to bypass security restrictions and trigger external protocol handlers. The root cause was that requests to open external protocol URLs did not account for the iframe's sandbox flags, and the sandbox state was not passed to the application's permission handlers. An attacker providing untrusted content within a sandboxed iframe could exploit this to launch OS-registered applications if the 'openExternal' permission was granted (which is the default behavior). The issue has been resolved by ensuring iframe sandbox flags are respected during external protocol navigation. Fixes are available in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

Affected products

  • Electron Electron < 39.8.8, >= 40.0.0-alpha.1, < 40.9.0, >= 41.0.0-alpha.1, < 41.2.1, >= 42.0.0-alpha.1, < 42.0.0-beta.3

Timeline

  • 2026-04-12: patched: Fixes merged into various release branches.
  • 2026-07-27: disclosed: Initial advisory publication.
  • 2026-08-05: advisory: Advisory updated and published to GitHub Advisory Database.

References