Disclosure summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Source-reported weakness categories
CWE-20
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-70607
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| electronjs | electron | * {"versionStartIncluding":"41.0.0","versionEndIncluding":"41.2.1"} |
| electronjs | electron | 42.0.0 |
| electronjs | electron | 42.0.0 |
| electronjs | electron | 42.0.0 |
| electronjs | electron | 42.0.0 |
| electronjs | electron | 42.0.0 |
| electronjs | electron | 42.0.0 |
| electronjs | electron | 42.0.0 |
| electronjs | electron | 42.0.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Patch
- github.com — Patch
- github.com — Patch
- github.com — Issue Tracking, Patch
- github.com — Issue Tracking, Patch
- github.com — Issue Tracking, Patch
- github.com — Issue Tracking, Patch
- github.com — Release Notes
- github.com — Release Notes
- github.com — Release Notes
- github.com — Release Notes
- github.com — Vendor Advisory
PUBLISHED 2026-08-05T13:16:54-04:00
MODIFIED 2026-10-08T09:53:43-04:00
INGESTED 2026-10-10T20:25:12-04:00