CVE-2026-70608 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected, while apps that deny window creation in setWindowOpenHandler or do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in 39.8.10, 41.10.3, and 42.0.1.
A vulnerability exists in Electron that allows a sandboxed iframe, lacking the 'allow-popups' keyword, to open new windows or trigger the 'setWindowOpenHandler' function without user interaction. This issue arises because the 'OpenURL' navigation path does not enforce the iframe's sandbox restrictions on popups. The vulnerability affects Electron versions prior to 39.8.10, 41.10.3, and 42.0.1. Applications that embed untrusted content in sandboxed iframes and depend on the absence of 'allow-popups' to block window creation are vulnerable. In contrast, apps that either deny window creation through 'setWindowOpenHandler' or do not use untrusted content in sandboxed iframes are not affected.
Users can update to Electron versions 39.8.10, 41.10.3, or 42.0.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | [email protected] |
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |