CVE-2026-70599 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
A vulnerability in Electron's permission handling for cross-origin iframes has been identified. In versions prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, permission checks for serial ports and media (camera and microphone) made from an iframe incorrectly passed the top-level frame origin to the permission check handler. This flaw could allow a cross-origin iframe to access devices in a way that was intended only for the top-level origin. The issue arises when apps use origin-based permission logic and embed cross-origin iframes with delegated device access. Apps that rely on the top-level origin or do not use such iframes are not affected.
Users can update to Electron versions 39.8.7, 40.9.0, 41.2.0, or 42.0.0-beta.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |