CVE-2026-70601

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.9 Electron versions prior to 40.9.2 Electron versions prior to 41.2.2 Electron versions prior to 42.0.0-beta.5

Description Applications that expose Promise-returning functions to web content via the contextBridge may be subject to a context isolation bypass. This allows untrusted web content to gain access to the isolated preload world and all capabilities assigned to the preload script. In renderers where a sandbox is not used or where nodeIntegration is enabled, this can lead to unauthorized Node.js access. This issue specifically affects applications that use contextBridge to wrap ipcRenderer.invoke in windows that load untrusted content.

Recommendations Update to version 39.8.9. Update to version 40.9.2. Update to version 41.2.2. Update to version 42.0.0-beta.5.