CVE-2026-70610 Details

A vulnerability exists in Electron's context bridge implementation, allowing objects from untrusted content to carry an attacker-influenced prototype. This could lead to prototype-pollution-style attacks on preload code, even with context isolation enabled. The issue affects Electron versions prior to 39.8.9, 40.0.0-alpha.1 through 40.9.2, 41.0.0-alpha.1 through 41.2.2, and 42.0.0-alpha.1 through 42.0.0-beta.4. Apps are only vulnerable if their preload code accepts object arguments from untrusted content and reads properties without checking for ownership. Those that only accept primitive values or validate object arguments are not impacted.

Update to Electron versions 39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.4.