CVE-2026-70607: Electron Path Traversal Vulnerability

CVE-2026-70607 Overview

CVE-2026-70607 affects the Electron framework, which is widely used to build cross-platform desktop applications with JavaScript, HTML, and CSS. The vulnerability stems from improper input validation [CWE-20] in the window.open() features string parser. Untrusted web content can supply arbitrary BrowserWindow options that the main process applies without an allowlist. Attackers can set options that cause the main process to access attacker-chosen file or network paths. The issue affects Electron versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

Critical Impact
Untrusted renderer content can influence privileged main-process BrowserWindow options, leading to attacker-controlled file or network path access when apps do not override child window options.

Affected Products

Electron versions prior to 39.8.8
Electron versions prior to 40.9.0 and 41.2.1
Electron 42.0.0-beta versions prior to 42.0.0-beta.3

Discovery Timeline

2026-08-05 - CVE-2026-70607 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70607

Vulnerability Analysis

Electron's window.open() implementation parses a features string that renderer content can control. Prior to the patch, the parser forwarded arbitrary keys from that string into BrowserWindow construction options. This bypasses the isolation boundary between untrusted web content and the privileged main process. Options that trigger filesystem or network side effects, such as those causing the main process to load attacker-chosen paths, could be set by remote content. The vulnerability is classified as improper input validation [CWE-20] and is exploitable over the network without authentication or user interaction.

Root Cause

The root cause lies in lib/browser/parse-features-string.ts, which lacked an allowlist for top-level BrowserWindow options. The parser accepted any key from the features string and passed it through to the window constructor. Applications that did not override child window creation with setWindowOpenHandler or overrideBrowserWindowOptions inherited this unsafe default. Renderer-controllable window options were therefore treated as trusted main-process configuration.

Attack Vector

Exploitation requires the application to load untrusted web content that can invoke window.open(). The attacker crafts a features string embedding sensitive BrowserWindow options. When the main process constructs the new window, it applies the attacker-supplied options, which may cause it to read local files or reach out to attacker-controlled network endpoints. Applications that already scope child window creation with setWindowOpenHandler are not affected.

typescript

// Security patch in lib/browser/parse-features-string.ts (#50949)
const allowedWebPreferences = ['zoomFactor', 'nodeIntegration', 'javascript', 'contextIsolation', 'webviewTag'] as const;
type AllowedWebPreference = (typeof allowedWebPreferences)[number];

// Top-level BrowserWindow options that may be set via the window.open()
// features string. Options not listed here are silently dropped; apps that
// need to pass other options should use setWindowOpenHandler in the main
// process.
const allowedWindowOptions = new Set<string>([
  // standard window.open() position/size features
  'top', 'left', 'innerWidth', 'innerHeight',
  // numeric
  'x', 'y', 'width', 'height',
  'minWidth', 'minHeight', 'maxWidth', 'maxHeight', 'opacity',
  // presentational booleans
  'show', 'center', 'useContentSize', 'frame', 'transparent', 'hasShadow',
  'movable', 'closable', 'focusable', 'minimizable', 'maximizable',
  'fullscreenable', 'alwaysOnTop', 'skipTaskbar', 'modal', 'acceptFirstMouse',
  'autoHideMenuBar', 'enableLargerThanScreen', 'paintWhenInitiallyHidden',
  'roundedCorners', 'thickFrame', 'disableAutoHideCursor', 'hiddenInMissionControl',
  // presentational strings (no filesystem/network side effects)
  'title', 'backgroundColor', 'tabbingIdentifier', 'titleBarStyle', 'vibrancy',
  'visualEffectState', 'backgroundMaterial'
]);

/**
 * Parses a feature string that has the format used in window.open().
 */

Source: GitHub Commit 30cf3882. The patch introduces the allowedWindowOptions allowlist so only presentational or geometry options can be set via the features string, silently dropping any option with filesystem or network side effects.

Detection Methods for CVE-2026-70607

Indicators of Compromise

Unexpected outbound network connections originating from an Electron application's main process to attacker-controlled hosts.
Electron application processes accessing files outside of their expected working directories or user data paths.
Renderer processes invoking window.open() with unusually long or option-heavy features strings.

Detection Strategies

Inventory installed Electron-based applications and identify versions older than 39.8.8, 40.9.0, or 41.2.1.
Perform static review of Electron application source for missing setWindowOpenHandler or overrideBrowserWindowOptions implementations.
Monitor for anomalous child process or file access behavior originating from Electron main processes handling untrusted web content.

Monitoring Recommendations

Log and alert on Electron application network egress to non-approved endpoints.
Track file read operations by Electron main processes targeting user profile directories or system paths.
Correlate renderer navigation events with subsequent main-process resource loads to identify option-injection patterns.

How to Mitigate CVE-2026-70607

Immediate Actions Required

Upgrade Electron to 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3 or later, then rebuild and redistribute affected applications.
Audit application code to ensure setWindowOpenHandler is defined and explicitly returns sanitized overrideBrowserWindowOptions.
Restrict the loading of untrusted remote content in Electron BrowserWindow instances that can invoke window.open().

Patch Information

Electron released fixed versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3. The change is tracked in GitHub Security Advisory GHSA-v93f-fgjr-hjrj and pull requests #50946, #50947, #50948, and #50949. Release notes are available on the v39.8.8, v40.9.0, v41.2.1, and v42.0.0-beta.3 tags.

Workarounds

Implement setWindowOpenHandler in the main process to return explicit overrideBrowserWindowOptions, filtering any renderer-supplied values.
Disable window.open() for untrusted contexts by returning { action: 'deny' } from the window open handler.
Sandbox renderers loading untrusted content and disable nodeIntegration while enforcing contextIsolation.

bash

# Configuration example: enforce a safe window.open handler in Electron main process
# main.js
const { app, BrowserWindow } = require('electron');

app.whenReady().then(() => {
  const win = new BrowserWindow({
    webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true }
  });

  win.webContents.setWindowOpenHandler(({ url }) => {
    // Deny renderer-controlled options; only allow vetted URLs with a fixed config
    if (!url.startsWith('https://trusted.example.com/')) return { action: 'deny' };
    return {
      action: 'allow',
      overrideBrowserWindowOptions: {
        webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true }
      }
    };
  });
});