Electron: window.open features string controls some window options considered privileged (CVE-2026-70607)
A vulnerability in Electron allows untrusted web content to control certain privileged window options via the window.open() features string. This can lead to the main process accessing attacker-chosen file or network paths if the app does not restrict or override these options. The issue affects Electron versions before 39.8.8 and is mitigated by denying window.open() calls from untrusted content or explicitly overriding window options. Fixed versions include 39.8.8 and later.
AI Analysis
Technical Summary
Electron versions prior to 39.8.8 are vulnerable to a flaw where some window options supplied by web content in the window.open() features string are applied to the new BrowserWindow without an allowlist. This allows untrusted content to set window options it should not control, potentially causing the main process to access attacker-chosen file or network paths. The vulnerability only affects apps that allow untrusted content to call window.open() without overriding child window options via setWindowOpenHandler or overrideBrowserWindowOptions. The issue is tracked as CVE-2026-70607 and has a CVSS 3.1 base score of 5.3 (medium severity).
Potential Impact
Untrusted web content can influence privileged window options in Electron, potentially causing the main process to access attacker-controlled file or network paths. This could lead to limited confidentiality impact but no integrity or availability impact is indicated. The vulnerability requires that untrusted content can invoke window.open() and that the app does not restrict or override window options. Apps that deny window.open() calls from untrusted content or explicitly override window options are not affected.
Mitigation Recommendations
A fix is available in Electron versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. Users should upgrade to one of these versions or later. As a workaround, apps can deny window.open() calls from untrusted content by returning { action: 'deny' } from setWindowOpenHandler, or explicitly set all child window options using overrideBrowserWindowOptions to prevent untrusted control of privileged options.
Electron: window.open features string controls some window options considered privileged (CVE-2026-70607)
Description
A vulnerability in Electron allows untrusted web content to control certain privileged window options via the window.open() features string. This can lead to the main process accessing attacker-chosen file or network paths if the app does not restrict or override these options. The issue affects Electron versions before 39.8.8 and is mitigated by denying window.open() calls from untrusted content or explicitly overriding window options. Fixed versions include 39.8.8 and later.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Electron versions prior to 39.8.8 are vulnerable to a flaw where some window options supplied by web content in the window.open() features string are applied to the new BrowserWindow without an allowlist. This allows untrusted content to set window options it should not control, potentially causing the main process to access attacker-chosen file or network paths. The vulnerability only affects apps that allow untrusted content to call window.open() without overriding child window options via setWindowOpenHandler or overrideBrowserWindowOptions. The issue is tracked as CVE-2026-70607 and has a CVSS 3.1 base score of 5.3 (medium severity).
Potential Impact
Untrusted web content can influence privileged window options in Electron, potentially causing the main process to access attacker-controlled file or network paths. This could lead to limited confidentiality impact but no integrity or availability impact is indicated. The vulnerability requires that untrusted content can invoke window.open() and that the app does not restrict or override window options. Apps that deny window.open() calls from untrusted content or explicitly override window options are not affected.
Mitigation Recommendations
A fix is available in Electron versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. Users should upgrade to one of these versions or later. As a workaround, apps can deny window.open() calls from untrusted content by returning { action: 'deny' } from setWindowOpenHandler, or explicitly set all child window options using overrideBrowserWindowOptions to prevent untrusted control of privileged options.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v93f-fgjr-hjrj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70607"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a73851dbf8831d5394ef583
Added to database: 08/05/2026, 18:46:53 UTC
Last enriched: 08/05/2026, 23:33:09 UTC
Last updated: 08/05/2026, 23:33:09 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.