CVE-2026-70606

Name of the Vulnerable Software and Affected Versions Electron versions prior to 40.10.6 Electron versions prior to 41.9.1 Electron versions prior to 42.5.1 Electron versions prior to 43.0.0

Description When a custom protocol handler returns a ProtocolResponse containing a url but lacking a session, the framework performs the upstream request via defaultSession rather than the session that handled the protocol. This behavior allows a cached response to be reused across session partitions that are intended to be isolated. This affects applications that utilize ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions for content isolation.

Recommendations Update to version 40.10.6. Update to version 41.9.1. Update to version 42.5.1. Update to version 43.0.0. Set ProtocolResponse.session explicitly to ensure the request utilizes the intended session cache.