CVE-2026-70600

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.8 Electron versions prior to 40.9.0 Electron versions prior to 41.2.1 Electron versions prior to 42.0.0-beta.3

Description A cross-origin iframe can position the native autofill popup outside its own bounds and over the UI of the embedding page. This behavior allows for clickjacking or the spoofing of trusted UI. This issue specifically affects applications that embed untrusted content in iframes within windows that also display trusted UI.

Recommendations Update to version 39.8.8. Update to version 40.9.0. Update to version 41.2.1. Update to version 42.0.0-beta.3. Do not embed untrusted content in iframes inside windows that display trusted UI.