CVE-2026-70599 in Electron
Summary
by MITRE • 08/05/2026
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability affects the Electron framework's permission handling mechanism for serial port and media devices when accessed through iframes. The flaw stems from incorrect origin propagation during permission checks, where the system incorrectly passes the top-level frame origin instead of the actual requesting iframe origin to the session.setPermissionCheckHandler function. This represents a critical authorization bypass issue that undermines the security boundaries between different origins within web applications.
The technical implementation flaw occurs in Electron's permission management system where iframe-based device access requests are not properly validated against the requesting context. When an iframe attempts to access serial port or media devices, the framework should verify permissions based on the iframe's own origin rather than the parent frame's origin. However, due to this bug, iframes can potentially gain access to hardware resources that were only intended for the top-level application origin, creating a cross-origin privilege escalation vector.
The operational impact of this vulnerability is significant as it allows malicious or compromised iframes to access sensitive hardware devices that are typically restricted to trusted origins. An attacker could embed an iframe with malicious code that attempts to access serial ports, webcams, microphones, or other media devices, bypassing the intended security boundaries. This creates potential for data exfiltration, device manipulation, and persistent access to system resources that should remain isolated from cross-origin content.
This vulnerability aligns with CWE-284 Access Control Issues, specifically addressing insufficient authorization controls where the system fails to properly validate access permissions based on the requesting context. The flaw also relates to ATT&CK technique T1059 Command and Scripting Interpreter, as it enables attackers to execute malicious code through compromised iframes that can then leverage device access capabilities. Additionally, it connects to ATT&CK technique T1217 Browser Features, where attackers exploit browser security features to gain unauthorized access to system resources.
The fix implemented in versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1 addresses the core issue by ensuring that permission checks properly utilize the requesting iframe origin instead of the top-level frame origin. This correction restores proper access control boundaries and prevents cross-origin iframes from inheriting permissions intended for the parent application context. Organizations should immediately upgrade to these patched versions to mitigate the risk of unauthorized device access through compromised iframes.
Mitigation strategies include implementing additional application-level checks beyond the framework's built-in permission handling, monitoring iframe behavior for suspicious device access attempts, and ensuring that applications using Electron properly configure their permission handlers with appropriate origin validation logic. Security teams should also consider implementing Content Security Policy directives to limit iframe creation and device access capabilities within their applications, while maintaining regular security audits to verify proper implementation of permission controls in Electron-based desktop applications.