CVE-2026-70609

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.7 Electron versions prior to 40.9.0 Electron versions prior to 41.2.0 Electron versions prior to 42.0.0-beta.1

Description The mode option of the webContents.openDevTools() function was not sanitized before use by the DevTools frontend. If an attacker can influence this value, they may execute scripts within the DevTools context. In unsandboxed configurations, this context has access to Node.js. This occurs when untrusted input reaches the mode argument of openDevTools() or when untrusted content calls openDevTools() on an embedded <webview>.

Recommendations Update to version 39.8.7. Update to version 40.9.0. Update to version 41.2.0. Update to version 42.0.0-beta.1. Only pass fixed, allowlisted values (right, bottom, undocked, detach) as the DevTools mode and avoid exposing openDevTools to untrusted content.