CVE-2026-70612

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.8 Electron versions prior to 40.9.0 Electron versions prior to 41.2.1 Electron versions prior to 42.0.0-beta.3

Description Requests to open external protocol URLs from web content do not respect iframe sandbox restrictions. This allows a sandboxed iframe to trigger the launch of an OS-registered external application. Additionally, the sandbox state of the frame is not provided to app permission handlers. This affects applications that render untrusted content within sandboxed iframes and grant the openExternal permission by default, which occurs when no setPermissionRequestHandler is installed.

Recommendations Update to version 39.8.8. Update to version 40.9.0. Update to version 41.2.1. Update to version 42.0.0-beta.3. Install a setPermissionRequestHandler that denies the openExternal permission for untrusted content.