CVE-2026-70599: Electron Auth Bypass Vulnerability

CVE-2026-70599 Overview

CVE-2026-70599 affects Electron, the framework for building cross-platform desktop applications with JavaScript, HTML, and CSS. The vulnerability resides in the synchronous permission check path for serial-port and media device access. When an iframe requested these permissions, Electron passed the top-level frame origin to session.setPermissionCheckHandler rather than the requesting iframe origin. Origin-based handler logic could therefore grant a cross-origin iframe device access intended only for the top-level origin. The issue is classified as [CWE-346] Origin Validation Error and is fixed in versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

Critical Impact
A malicious cross-origin iframe embedded in an Electron application can obtain serial-port or media (camera/microphone) permissions that the user granted only to the top-level origin.

Affected Products

Electron versions prior to 39.8.7
Electron 40.x versions prior to 40.9.0
Electron 41.x versions prior to 41.2.0 and 42.0.0-beta.1

Discovery Timeline

2026-08-05 - CVE-2026-70599 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70599

Vulnerability Analysis

Electron exposes an application-defined handler through session.setPermissionCheckHandler that gates access to sensitive device APIs, including Web Serial and media capture. Application developers typically build allow/deny logic around the requestingOrigin argument passed to the handler. Prior to the fixed versions, the synchronous permission check path used the top-level frame's committed origin instead of the origin of the render frame actually issuing the request. A cross-origin iframe embedded in a trusted page therefore inherited the trust decision associated with its parent. Any handler that returned true for the top-level origin would grant the iframe access to serial ports or media devices without the developer's intent.

Root Cause

The defect is an origin validation error in Electron's C++ browser-process bindings. In shell/browser/api/electron_api_web_contents.cc and shell/browser/serial/electron_serial_delegate.cc, the permission helpers received only a security_origin string derived from the top-level frame instead of a reference to the requesting RenderFrameHost. Downstream logic could not distinguish an iframe request from a top-level request.

Attack Vector

Exploitation requires an Electron application that embeds untrusted third-party content in an iframe and relies on origin-based checks inside setPermissionCheckHandler. Attacker-controlled iframe content invokes navigator.serial.getPorts(), navigator.serial.requestPort(), or navigator.mediaDevices.getUserMedia(). The handler evaluates the top-level origin, approves the call, and the iframe receives access to hardware it should not reach.

The upstream patch propagates the requesting frame through the synchronous permission checks:

text

       content::WebContents::FromRenderFrameHost(render_frame_host);
   auto* permission_helper =
       WebContentsPermissionHelper::FromWebContents(web_contents);
-  return permission_helper->CheckMediaAccessPermission(security_origin, type);
+  return permission_helper->CheckMediaAccessPermission(render_frame_host,
+                                                       security_origin, type);
 }

 void WebContents::RequestMediaAccessPermission(

Source: electron/electron commit 0cbdf2f

text

   auto* web_contents = content::WebContents::FromRenderFrameHost(frame);
   auto* permission_helper =
       WebContentsPermissionHelper::FromWebContents(web_contents);
-  return permission_helper->CheckSerialAccessPermission(
-      frame->GetLastCommittedOrigin());
+  return permission_helper->CheckSerialAccessPermission(frame);
 }

 bool ElectronSerialDelegate::HasPortPermission(

Source: electron/electron commit 0cbdf2f

Detection Methods for CVE-2026-70599

Indicators of Compromise

Electron application binaries bundling framework versions older than 39.8.7, 40.9.0, or 41.2.0.
Unexpected serial-port enumeration or media capture initiated from cross-origin iframe contexts.
Application logs showing setPermissionCheckHandler approvals where the requestingOrigin does not match the frame that later exercised the granted device.

Detection Strategies

Inventory installed Electron applications and compare their bundled framework version against the fixed releases listed in GHSA-9pf5-hg6p-4pwp.
Audit application source for uses of session.setPermissionCheckHandler that make trust decisions based on requestingOrigin while also embedding third-party iframes.
Instrument custom permission handlers to log both the handler-provided origin and the frame's actual origin, and alert on mismatches.

Monitoring Recommendations

Monitor endpoints for Electron-based applications that call Web Serial or getUserMedia APIs when hardware access is not part of expected user workflows.
Track outbound connections from Electron apps to unexpected third-party domains loaded within iframes.
Correlate device-access telemetry with application version data to prioritize hosts running vulnerable Electron builds.

How to Mitigate CVE-2026-70599

Immediate Actions Required

Upgrade the Electron framework used by your applications to 39.8.7, 40.9.0, 41.2.0, or 42.0.0-beta.1 or later.
Rebuild and redistribute any downstream applications that ship a vulnerable Electron runtime.
Review setPermissionCheckHandler implementations to confirm they validate the requesting frame, not only the top-level origin.

Patch Information

The fix landed in Electron commit 0cbdf2f and is released in versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1. Full advisory details are available in GHSA-9pf5-hg6p-4pwp.

Workarounds

Deny serial and media permissions outright for any request where the embedding context includes untrusted iframes until the framework is upgraded.
Disable iframe embedding of third-party content by setting a strict Content Security Policy frame-src directive.
Use webContents.setWindowOpenHandler and will-attach-webview to prevent unexpected frame or webview creation.

bash

# Verify the Electron version bundled with an application
npx electron --version

# Upgrade the Electron dependency to a fixed release
npm install --save-dev electron@^41.2.0