CVE-2026-70602: Electron: Extension tab APIs operate across session boundaries
Impact Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session.
Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. Apps that do not load extensions, or that use a single session, are not affected.
Workarounds Only load extensions from sources you trust; do not rely on session separation alone to contain an extension.
Fixed Versions 42.0.0-beta.3 41.2.1 40.9.0 39.8.8
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 39.8.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 40.9.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 41.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 42.0.0-beta.3 - Compensating control
Only load extensions from sources you trust; do not rely on session separation alone to contain an extension.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70602?
The severity of CVE-2026-70602 is rated as medium with a score of 6.6.
What is the impact of CVE-2026-70602?
CVE-2026-70602 allows a malicious or compromised extension to navigate, script, and read from windows belonging to a different session.
Which software is affected by CVE-2026-70602?
CVE-2026-70602 affects applications that load Chrome extensions via npm or Electron.
How do I fix CVE-2026-70602?
To fix CVE-2026-70602, ensure that you are updating to the latest version of the Electron framework that includes security patches.
What are the risks associated with CVE-2026-70602?
The risks associated with CVE-2026-70602 include unauthorized access and manipulation of content in different browser sessions.