CVE-2026-70600: Electron: Cross-origin iframe can position native autofill popup
Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI.
Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected.
Workarounds Do not embed untrusted content in iframes inside windows that display trusted UI.
Fixed Versions 42.0.0-beta.3 41.2.1 40.9.0 39.8.8
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Configuration
Ensure your Electron app does not embed untrusted third-party content in iframes inside windows that display trusted UI (to mitigate cross-origin iframe positioning of the native autofill popup prior to 39.8.8 / 40.9.0 / 41.2.1 / 42.0.0-beta.3).
Electron apps (iframe usage) Do not embed untrusted content in iframes inside windows that display trusted UI = Do not embed untrusted iframes in trusted-UI windows
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70600?
CVE-2026-70600 has a low severity score of 3.1.
What is the impact of CVE-2026-70600?
CVE-2026-70600 allows a cross-origin iframe to position a native autofill popup over the embedding page's UI, potentially leading to clickjacking or UI spoofing.
How do I fix CVE-2026-70600?
To fix CVE-2026-70600, ensure that you do not embed untrusted content in iframes when displaying trusted UI.
Which software is affected by CVE-2026-70600?
CVE-2026-70600 affects the npm/electron software.
When was CVE-2026-70600 published?
CVE-2026-70600 was published on August 5, 2026.