CVE-2026-70601: Electron: Context isolation bypass via Function.prototype.bind hijack
Impact Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access.
Apps are affected if they expose Promise-returning functions via contextBridge — the standard pattern for wrapping ipcRenderer.invoke — in windows that load untrusted content. Apps that never load untrusted content in those windows are not affected.
Workarounds There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions 42.0.0-beta.5 41.2.2 40.9.2 39.8.9
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.5 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.2 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.2 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 39.8.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 40.9.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 41.2.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 42.0.0-beta.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70601?
The severity of CVE-2026-70601 is classified as high with a CVSS score of 7.5.
How do I fix CVE-2026-70601?
To fix CVE-2026-70601, ensure that the `contextBridge` is securely handling Promise-returning functions and avoid exposing sensitive capabilities to untrusted web content.
What is the impact of CVE-2026-70601?
CVE-2026-70601 can allow untrusted web content to bypass context isolation and gain access to the preload script's capabilities.
Which software is affected by CVE-2026-70601?
CVE-2026-70601 affects applications built with npm/electron that expose Promise-returning functions to web content.
When was CVE-2026-70601 published?
CVE-2026-70601 was published on August 5, 2026.