CVE-2026-70599: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin
Impact For serial-port and media (camera / microphone) permission checks made from an iframe, the requestingOrigin passed to session.setPermissionCheckHandler was the top-level frame's origin rather than the requesting frame's. Origin-based handler logic could therefore grant a cross-origin iframe device access intended only for the top-level origin.
Apps are only affected if they use setPermissionCheckHandler with origin-based logic and embed cross-origin iframes with delegated device permissions. Apps that base the decision on details.securityOrigin, or that do not embed such iframes, are not affected.
Workarounds Check details.securityOrigin instead of requestingOrigin for these permissions, or do not delegate device permissions to untrusted iframes.
Fixed Versions 42.0.0-beta.1 41.2.0 40.9.0 39.8.7
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.7 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 39.8.7 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 41.2.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.1 - Configuration
Check details.securityOrigin instead of requestingOrigin for serial-port and media permissions.
Electron session.setPermissionCheckHandler Permission origin check = details.securityOrigin - Compensating control
Do not delegate device permissions to untrusted cross-origin iframes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70599?
The severity of CVE-2026-70599 is rated as medium with a CVSS score of 5.9.
Who is affected by CVE-2026-70599?
CVE-2026-70599 affects applications built using the npm/electron framework.
How do I fix CVE-2026-70599?
To fix CVE-2026-70599, update your Electron framework to the latest version where the vulnerability is resolved.
What type of vulnerability is CVE-2026-70599?
CVE-2026-70599 is a cross-origin permission check vulnerability related to serial-port and media access from iframes.
What are the implications of CVE-2026-70599?
CVE-2026-70599 may allow malicious iframes to bypass permission checks, potentially compromising security.