CVE-2026-70607

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.8 Electron versions prior to 40.9.0 Electron versions prior to 41.2.1 Electron versions prior to 42.0.0-beta.3

Description Certain window options provided by web content within the window.open() features string are applied to the new BrowserWindow without an allowlist. This allows untrusted content to control window options that could lead the main process to access file or network paths chosen by an attacker. This occurs when untrusted content can call window.open() and the application fails to override child window options using setWindowOpenHandler or overrideBrowserWindowOptions.

Recommendations Update to version 39.8.8. Update to version 40.9.0. Update to version 41.2.1. Update to version 42.0.0-beta.3. Return { action: 'deny' } from setWindowOpenHandler for untrusted content. Supply overrideBrowserWindowOptions to ensure every window option is set explicitly.