CVE-2026-70599 - Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Back Back to CVE browser

MEDIUM

Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

Published Aug 5, 2026

5.9

MEDIUM

CVSS 3.1

EPSS 0.19%

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

Affected products

Vendor Electron Product Electron Default
n/a
- Version
  < 39.8.7
  Status
  affected
  Constraints
  -
- Version
  >= 40.0.0-alpha.1, < 40.9.0
  Status
  affected
  Constraints
  -
- Version
  >= 41.0.0-alpha.1, < 41.2.0
  Status
  affected
  Constraints
  -
- Version
  >= 42.0.0-alpha.1, < 42.0.0-beta.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Electron

n/a

Version	Status	Constraints
< 39.8.7	affected	-
>= 40.0.0-alpha.1, < 40.9.0	affected	-
>= 41.0.0-alpha.1, < 41.2.0	affected	-
>= 42.0.0-alpha.1, < 42.0.0-beta.1	affected	-

electron

npm

Introduced 0 Fixed 39.8.7
electron

npm

Introduced 40.0.0-alpha.1 Fixed 40.9.0
electron

npm

Introduced 41.0.0-alpha.1 Fixed 41.2.0
electron

npm

Introduced 42.0.0-alpha.1 Fixed 42.0.0-beta.1

Ecosystem	Package	Introduced	Fixed
npm	electron	0	39.8.7
npm	electron	40.0.0-alpha.1	40.9.0
npm	electron	41.0.0-alpha.1	41.2.0
npm	electron	42.0.0-alpha.1	42.0.0-beta.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-346

References (3)

https://github.com/advisories/GHSA-9pf5-hg6p-4pwp
Advisory
https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c
x_refsource_MISC
https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp
x_refsource_CONFIRM

Link	Providers	Tags
https://github.com/advisories/GHSA-9pf5-hg6p-4pwp		Advisory
https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c		x_refsource_MISC
https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp		x_refsource_CONFIRM