CVE-2026-70599

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.7 Electron versions prior to 40.9.0 Electron versions prior to 41.2.0 Electron versions prior to 42.0.0-beta.1

Description Serial-port and media (camera and microphone) permission checks initiated from an iframe incorrectly pass the top-level frame origin to the session.setPermissionCheckHandler function instead of the origin of the requesting iframe. This behavior allows origin-based handler logic to potentially grant a cross-origin iframe access to devices that should only be accessible to the top-level origin. This issue specifically affects applications that utilize setPermissionCheckHandler with origin-based logic and embed cross-origin iframes with delegated device permissions.

Recommendations Update to version 39.8.7. Update to version 40.9.0. Update to version 41.2.0. Update to version 42.0.0-beta.1. As a workaround, use details.securityOrigin instead of requestingOrigin for permission checks or avoid delegating device permissions to untrusted iframes.