CVE-2026-70610 is a prototype pollution vulnerability in Electron's contextBridge feature. When objects are copied across the contextBridge boundary from untrusted content, they may retain attacker-controlled prototype setters. This can lead to prototype-pollution-style attacks against preload scripts even when context isolation is enabled. The vulnerability only affects applications whose preload code accepts object arguments from untrusted sources and accesses properties without verifying own properties. Electron has released fixes in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4 to address this issue.

An attacker can influence the prototype of objects passed from untrusted content to preload code, potentially causing unexpected behavior or security issues in preload scripts. This can occur despite context isolation being enabled. The impact is limited to applications that accept and use object arguments from untrusted content without proper validation. Applications that only accept primitive arguments or validate objects with own-property checks are not affected.

A fix is available in Electron versions 39.8.9 and later. Users should upgrade to one of these fixed versions. As a workaround, preload code should validate objects received from untrusted content using own-property checks (e.g., Object.hasOwn) or copy objects onto null-prototype objects before use to prevent prototype pollution.