Log in Start free

Vulnerability · Published Aug 5, 2026 · Assigned by GitHub_M

CVE-2026-70610Electron: contextBridge object copy honors prototype setters

Medium 5.4

In plain English

A medium-severity prototype pollution in electron from electron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmelectron39.8.9GHSA-ff2p-hmqr-hxm4
npmelectron40.9.2GHSA-ff2p-hmqr-hxm4
npmelectron41.2.2GHSA-ff2p-hmqr-hxm4
npmelectron42.0.0-beta.4GHSA-ff2p-hmqr-hxm4

Affected products (as reported)

VendorProductVersions
electron electron < 39.8.9>= 40.0.0-alpha.1, < 40.9.2>= 41.0.0-alpha.1, < 41.2.2>= 42.0.0-alpha.1, < 42.0.0-beta.4

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References