CVE-2026-70599Medium· 5.9▾ SunlitElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
0.1% → 0.2%
Last analysed / modified upstream
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
electron < 39.8.7electron >= 40.0.0, < 40.9.0electron >= 41.0.0, < 41.2.1electron = 42.0.0Upgrade past the affected range:
electron 41.2.1Affected packages:
electron < 39.8.7electron >= 40.0.0-alpha.1, < 40.9.0electron >= 41.0.0-alpha.1, < 41.2.0electron >= 42.0.0-alpha.1, < 42.0.0-beta.1Patched in:
electron 39.8.7electron 40.9.0electron 41.2.0electron 42.0.0-beta.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin
CVE-2026-114121Medium· 5.4Electron: openExternal permission requests can be attributed to the wrong origin
CVE-2026-102673High· 8.2Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102675High· 7.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-115570High· 7.4Electron: Mitigation for compromised eMudhra intermediate certificates