Electron up to 39.8.7/40.8.x/41.2.0/42.0.0-beta.2 iFrame Sandbox setPermissionRequestHandler sandbox

Summaryinfo

A vulnerability was found in Electron up to 39.8.7/40.8.x/41.2.0/42.0.0-beta.2. It has been rated as critical. Affected by this issue is the function setPermissionRequestHandler of the component iFrame Sandbox. This manipulation causes sandbox. This vulnerability is registered as CVE-2026-70612. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability has been found in Electron up to 39.8.7/40.8.x/41.2.0/42.0.0-beta.2 and classified as critical. Affected by this vulnerability is the function setPermissionRequestHandler of the component iFrame Sandbox. The manipulation with an unknown input leads to a sandbox vulnerability. The CWE definition for the vulnerability is CWE-265. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame sandbox state was also not made available to the app permission handlers, affecting apps that render untrusted content in sandboxed iframes and grant the openExternal permission by default when no setPermissionRequestHandler is installed. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-70612 since 08/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1611 for this issue.

Upgrading to version 39.8.8, 40.9.0, 41.2.1 or 42.0.0-beta.3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Electron

Version

• 39.8.0
• 39.8.1
• 39.8.2
• 39.8.3
• 39.8.4
• 39.8.5
• 39.8.6
• 39.8.7
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7
• 40.8
• 41.0
• 41.1
• 41.2.0
• 42.0.0-beta.0
• 42.0.0-beta.1
• 42.0.0-beta.2

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion