CVE-2026-70606: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions.
Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. Apps that set an explicit session, or that do not isolate content across sessions, are not affected.
Workarounds Set ProtocolResponse.session explicitly so the request uses the intended session's cache.
Fixed Versions 43.0.0 42.5.1 41.9.1 40.10.6
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.10.6 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.9.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.5.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.0.0 - Upgrade
Upgrade
electron/electronto a version that resolves this vulnerability.Fixed in 40.10.6 - Upgrade
Upgrade
electron/electronto a version that resolves this vulnerability.Fixed in 41.9.1 - Upgrade
Upgrade
electron/electronto a version that resolves this vulnerability.Fixed in 42.5.1 - Upgrade
Upgrade
electron/electronto a version that resolves this vulnerability.Fixed in 43.0.0 - Configuration
If a custom protocol handler returns a ProtocolResponse with a ProtocolResponse.url and no ProtocolResponse.session, set ProtocolResponse.session explicitly so the upstream request uses the intended session cache instead of defaultSession.
Electron custom protocol handler (ProtocolResponse) ProtocolResponse.session = Set explicitly (do not omit when returning ProtocolResponse.url)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70606?
The severity of CVE-2026-70606 is medium with a score of 5.9.
How do I fix CVE-2026-70606?
To address CVE-2026-70606, ensure you are using the latest version of Electron that contains the fix for this vulnerability.
What impact does CVE-2026-70606 have on my application?
CVE-2026-70606 allows a cached response to be reused across isolated session partitions, potentially exposing sensitive data.
Which software is affected by CVE-2026-70606?
CVE-2026-70606 affects the Electron framework, specifically versions prior to the fix.
When was CVE-2026-70606 published?
CVE-2026-70606 was published on August 5, 2026.