Electron: ProtocolResponse.url reuses the default session cache instead of the registering session (CVE-2026-70606)
Electron versions prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0 contain a vulnerability where a custom protocol handler returning a ProtocolResponse with a url but without an explicit session causes the request to use the default session cache. This leads to potential cache reuse across isolated session partitions, undermining session isolation. Applications that explicitly set the session or do not isolate content across sessions are not affected. A fix is available in the specified versions.
AI Analysis
Technical Summary
In Electron, when a custom protocol handler returns a ProtocolResponse containing a url but omits the session property, the framework incorrectly uses the defaultSession to make the upstream request instead of the session that registered the protocol. This behavior causes cached responses to be reused across session partitions that are intended to be isolated, potentially leaking cached content between sessions. The issue affects applications relying on separate sessions for content isolation and that do not explicitly set the ProtocolResponse.session property. Electron fixed this vulnerability in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.
Potential Impact
The vulnerability allows cached responses to be reused across session partitions that should be isolated, potentially leading to unintended data exposure between isolated sessions. This compromises the confidentiality of cached content in applications that rely on session isolation via custom protocol handlers without explicitly setting the session property in ProtocolResponse. There is no indication of privilege escalation or denial of service. The CVSS score is 5.9 (medium severity) reflecting network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
A fix is available in Electron versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0. Applications should upgrade to one of these fixed versions. As a workaround, developers can explicitly set the ProtocolResponse.session property to ensure that the request uses the intended session's cache, preventing cross-session cache reuse. No other mitigations are specified.
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session (CVE-2026-70606)
Description
Electron versions prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0 contain a vulnerability where a custom protocol handler returning a ProtocolResponse with a url but without an explicit session causes the request to use the default session cache. This leads to potential cache reuse across isolated session partitions, undermining session isolation. Applications that explicitly set the session or do not isolate content across sessions are not affected. A fix is available in the specified versions.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Electron, when a custom protocol handler returns a ProtocolResponse containing a url but omits the session property, the framework incorrectly uses the defaultSession to make the upstream request instead of the session that registered the protocol. This behavior causes cached responses to be reused across session partitions that are intended to be isolated, potentially leaking cached content between sessions. The issue affects applications relying on separate sessions for content isolation and that do not explicitly set the ProtocolResponse.session property. Electron fixed this vulnerability in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.
Potential Impact
The vulnerability allows cached responses to be reused across session partitions that should be isolated, potentially leading to unintended data exposure between isolated sessions. This compromises the confidentiality of cached content in applications that rely on session isolation via custom protocol handlers without explicitly setting the session property in ProtocolResponse. There is no indication of privilege escalation or denial of service. The CVSS score is 5.9 (medium severity) reflecting network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.
Mitigation Recommendations
A fix is available in Electron versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0. Applications should upgrade to one of these fixed versions. As a workaround, developers can explicitly set the ProtocolResponse.session property to ensure that the request uses the intended session's cache, preventing cross-session cache reuse. No other mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-r4w5-6pfg-jxp5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70606"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a73851ebf8831d5394ef7ba
Added to database: 08/05/2026, 18:46:54 UTC
Last enriched: 08/05/2026, 23:45:40 UTC
Last updated: 08/05/2026, 23:45:40 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.