CVE-2026-70606
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
- EPSS probability
- 0.16%
- CWE
- CWE-668
- Published
- 2026-08-05
- Last modified
- 2026-08-05
Affected products
- electron electron
- electron electron
- electron electron
- electron electron
Weakness type
Related vulnerabilities
- CVE-2026-85053 — Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote...
- CVE-2026-82652 — SiYuan before v3.8.1 Information Disclosure via Publish Access
- CVE-2026-82650 — SiYuan before v3.8.1 Path Traversal via /api/template/render
- CVE-2026-72924 — GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default
- CVE-2026-79068 — Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote...
- CVE-2026-79031 — Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote...
- CVE-2026-59308 — Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation
- CVE-2026-73843 — OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs