CVE-2026-70601 electron CVE debrief

Who should care

Developers and administrators of Electron applications that use contextBridge to expose Promise-returning functions to untrusted web content should assess exposure and verify Electron versions.

Why it matters

CVE-2026-70601 is a high-severity vulnerability in Electron that could allow context isolation bypass, potentially leading to access to sensitive capabilities and Node.js access in certain configurations. Developers and administrators of affected Electron applications should assess exposure, verify versions, and update if necessary.

• Potential access to isolated preload world capabilities.
• Possible escalation to Node.js access in vulnerable renderers.
• Need to verify Electron version and update if necessary.
• Review of ipcRenderer.invoke usage in windows loading untrusted content.

Technical summary

Electron apps exposing Promise-returning functions to web content via contextBridge may be vulnerable to context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. The issue is fixed in Electron versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5. Developers should assess exposure, verify versions, and update if necessary. Affected apps expose Promise-returning functions via contextBridge, a pattern often used for wrapping ipcRenderer.invoke, in windows that load untrusted content.

Defensive priority

High

Recommended defensive actions

• Assess exposure of Electron apps that use contextBridge to expose Promise-returning functions to untrusted web content.
• Verify if the Electron version is prior to 39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.5.
• Update Electron to a fixed version if vulnerable.
• Review ipcRenderer.invoke usage in windows that load untrusted content.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Electron apps exposing Promise-returning functions to web content via contextBridge may be vulnerable to context isolation bypass. The issue is fixed in Electron versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.