CVE-2026-70610

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.9 Electron versions prior to 40.9.2 Electron versions prior to 41.2.2 Electron versions prior to 42.0.0-beta.4

Description Objects copied across the contextBridge boundary from untrusted content can carry an attacker-influenced prototype. This allows prototype-pollution-style attacks against preload code even when context isolation is enabled. Prototype pollution is a technique where an attacker manipulates the prototype of an object to inject properties that can change the behavior of the application. This issue affects applications where preload code accepts object arguments from untrusted content and reads properties from them without performing own-property checks.

Recommendations Update to version 39.8.9. Update to version 40.9.2. Update to version 41.2.2. Update to version 42.0.0-beta.4. Validate objects received from untrusted content using own-property checks (Object.hasOwn) or copy them onto a null-prototype object before use.