Electron up to 39.8.6/40.8.x/41.1.x/42.0.0-beta.0 DevTools webContents.openDevTools mode sandbox

Summaryinfo

A vulnerability was found in Electron up to 39.8.6/40.8.x/41.1.x/42.0.0-beta.0 and classified as critical. The affected element is the function webContents.openDevTools of the component DevTools. Such manipulation of the argument mode leads to sandbox. This vulnerability is listed as CVE-2026-70609. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Electron up to 39.8.6/40.8.x/41.1.x/42.0.0-beta.0 and classified as critical. Affected by this issue is the function webContents.openDevTools of the component DevTools. The manipulation of the argument mode with an unknown input leads to a sandbox vulnerability. Using CWE to declare the problem leads to CWE-265. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-70609 since 08/04/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1611.

Upgrading to version 39.8.7, 40.9.0, 41.2.0 or 42.0.0-beta.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Electron

Version

• 39.8.0
• 39.8.1
• 39.8.2
• 39.8.3
• 39.8.4
• 39.8.5
• 39.8.6
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7
• 40.8
• 41.0
• 41.1
• 42.0.0-beta

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion