CVE-2026-70607: Electron: window.open features string controls some window options considered privileged
Impact Some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths.
Apps are only affected if untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler. Apps that deny window.open() for untrusted content, or set overrideBrowserWindowOptions explicitly, are not affected.
Workarounds Return { action: 'deny' } from setWindowOpenHandler for untrusted content, or supply overrideBrowserWindowOptions so every window option is set explicitly.
Fixed Versions 42.0.0-beta.3 41.2.1 40.9.0 39.8.8
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Configuration
For untrusted content, return { action: 'deny' } from setWindowOpenHandler, or supply overrideBrowserWindowOptions so every window option is set explicitly.
Electron setWindowOpenHandler / overrideBrowserWindowOptions = deny untrusted window.open() calls or explicitly set every window option
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70607?
The severity of CVE-2026-70607 is rated as medium, with a CVSS score of 5.3.
How do I fix CVE-2026-70607?
To mitigate CVE-2026-70607, ensure that you implement strict validation on the window options used in the window.open() feature.
What is the impact of CVE-2026-70607?
The impact of CVE-2026-70607 is that untrusted web content can manipulate window options improperly, which may allow unauthorized file access.
What software is affected by CVE-2026-70607?
CVE-2026-70607 affects the npm package Electron.
What type of vulnerability is CVE-2026-70607 classified as?
CVE-2026-70607 is classified as an Input Validation vulnerability.