Electron up to 39.8.9/41.10.2/42.0.0 iFrame Sandbox sandbox

Summaryinfo

A vulnerability has been found in Electron up to 39.8.9/41.10.2/42.0.0 and classified as critical. Impacted is an unknown function of the component iFrame Sandbox. This manipulation causes sandbox. This vulnerability is tracked as CVE-2026-70608. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in Electron up to 39.8.9/41.10.2/42.0.0 and classified as critical. Affected by this vulnerability is an unknown part of the component iFrame Sandbox. The manipulation with an unknown input leads to a sandbox vulnerability. The CWE definition for the vulnerability is CWE-265. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-70608 since 08/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1611 according to MITRE ATT&CK.

Upgrading to version 39.8.10, 41.10.3 or 42.0.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Electron

Version

• 39.8.0
• 39.8.1
• 39.8.2
• 39.8.3
• 39.8.4
• 39.8.5
• 39.8.6
• 39.8.7
• 39.8.8
• 39.8.9
• 41.10.0
• 41.10.1
• 41.10.2
• 42.0

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion