CVE-2026-70606 Overview
CVE-2026-70606 is a session isolation flaw in Electron, the framework for building cross-platform desktop applications with JavaScript, HTML, and CSS. When a custom protocol handler returns a ProtocolResponse containing a url but no session, Electron routes the upstream request through defaultSession instead of the session that handled the protocol. A cached response can then be reused across otherwise isolated session partitions, breaking the boundary between them. The issue affects applications that rely on separate sessions to isolate content. Fixed versions are 40.10.6, 41.9.1, 42.5.1, and 43.0.0.
Critical Impact
Cross-session cache reuse can leak authenticated or sensitive responses between partitions that developers expect to remain isolated.
Affected Products
- Electron versions prior to 40.10.6
- Electron versions prior to 41.9.1 in the 41.x branch
- Electron versions prior to 42.5.1 in the 42.x branch, and prior to 43.0.0 in the 43.x branch
Discovery Timeline
- 2026-08-05 - CVE-2026-70606 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-70606
Vulnerability Analysis
Electron applications commonly register custom protocol handlers using APIs such as protocol.handle on a specific Session instance. The handler returns a ProtocolResponse describing how Electron should fulfill the request. When that response includes a url field to redirect the fetch upstream, and omits the session field, Electron performs the upstream request using defaultSession rather than the session that originally intercepted the protocol.
This breaks partition isolation. Responses fetched through defaultSession populate its HTTP cache, and subsequent requests from other partitions can hit the same cached entry. Applications that separate content by session, for example placing tenant, workspace, or user contexts into distinct partition values, lose the security boundary they configured. This weakness maps to CWE-668: Exposure of Resource to Wrong Sphere.
Root Cause
The root cause is missing propagation of the intercepting session when Electron resolves a ProtocolResponse.url. The code path defaults to defaultSession when ProtocolResponse.session is unset, rather than falling back to the session that owns the protocol handler.
Attack Vector
Exploitation requires user interaction and a specific application pattern: a custom protocol handler that returns ProtocolResponse.url without ProtocolResponse.session, combined with multiple sessions used for content isolation. An attacker who can influence content in one partition can prime the shared defaultSession cache, and a victim loading a related resource in another partition can receive the cached response. See the Electron GitHub Security Advisory GHSA-r4w5-6pfg-jxp5 for the maintainer analysis.
No verified proof-of-concept code is published. The vulnerability behavior is described in prose in the advisory.
Detection Methods for CVE-2026-70606
Indicators of Compromise
- Unexpected cache hits or shared cookies observed across Electron Session partitions that the application configured as isolated.
- Custom protocol handlers in application source that call callback({ url: ... }) or return ProtocolResponse objects without setting session.
- Network telemetry showing upstream fetches from an Electron process attributed to defaultSession when a partitioned session was expected.
Detection Strategies
- Perform static review of Electron application code for protocol.handle, protocol.registerStreamProtocol, and related APIs where the returned response includes url but no session.
- Inventory installed Electron runtime versions across managed endpoints and flag any build below 40.10.6, 41.9.1, or 42.5.1.
- Instrument test builds to log the session used for upstream fetches originating from custom protocol handlers.
Monitoring Recommendations
- Track Electron version metadata in software inventory feeds and alert on outdated releases.
- Monitor endpoint process telemetry for Electron-based applications generating network requests that cross expected partition boundaries.
- Correlate application update events with vendor advisories to confirm patched builds are deployed.
How to Mitigate CVE-2026-70606
Immediate Actions Required
- Upgrade Electron to 40.10.6, 41.9.1, 42.5.1, or 43.0.0 or later, matching the branch in use.
- Audit all custom protocol handlers and ensure any ProtocolResponse that sets url also sets session to the intended Session instance.
- Rebuild and redistribute affected Electron applications to end users after upgrading the framework.
Patch Information
The Electron maintainers fixed the issue in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0. Patch notes and remediation details are published in the GitHub Security Advisory GHSA-r4w5-6pfg-jxp5.
Workarounds
- Explicitly set ProtocolResponse.session to the session that registered the handler whenever returning a url.
- Avoid returning ProtocolResponse.url from custom protocol handlers; fetch the upstream resource in application code using the intended session and return the buffer or stream directly.
- Disable HTTP caching for sessions that must remain isolated until the runtime is upgraded.
# No configuration example is published for this issue.
# Remediation is code-level: pass the intercepting session in ProtocolResponse
# or upgrade Electron to a fixed version (40.10.6, 41.9.1, 42.5.1, or 43.0.0).
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
