CVE-2026-70610: Electron Prototype Pollution Vulnerability

CVE-2026-70610 Overview

CVE-2026-70610 is a prototype pollution vulnerability [CWE-1321] in the Electron framework, which is widely used for building cross-platform desktop applications with JavaScript, HTML, and CSS. Objects copied across the contextBridge boundary from untrusted content can carry an attacker-influenced prototype. This allows prototype-pollution-style attacks against preload code even when context isolation is enabled. The flaw affects Electron versions prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4. Applications are only vulnerable if their preload code accepts object arguments from untrusted content and reads properties without own-property checks.

Critical Impact
Attackers controlling untrusted web content can pollute prototypes reachable by preload scripts, undermining a core Electron security boundary and potentially escalating access from the renderer into privileged preload code.

Affected Products

Electron versions prior to 39.8.9
Electron versions prior to 40.9.2 and 41.2.2
Electron versions prior to 42.0.0-beta.4

Discovery Timeline

2026-08-05 - CVE-2026-70610 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70610

Vulnerability Analysis

Electron's contextBridge is designed to safely expose APIs from privileged preload scripts to untrusted renderer content. When copying objects across the bridge, Electron previously used v8::Object::Set to assign properties on a proxy object in the destination context. Set respects inherited setters on Object.prototype, including the __proto__ accessor. An attacker in the renderer can send an object whose keys include __proto__, causing the destination proxy's prototype to be mutated instead of an own property being created.

This breaks the isolation guarantee that contextBridge is expected to provide. Preload code that later reads properties from the received object without using own-property checks such as Object.hasOwn() or Object.prototype.hasOwnProperty.call() will read attacker-controlled values from the polluted prototype chain.

Root Cause

The root cause is the use of proxy.Set(key, passed_value) in shell/renderer/api/electron_api_context_bridge.cc during object proxying. The Set operation triggers inherited accessor setters, so a key of __proto__ walks up to Object.prototype.__proto__ and reassigns the prototype rather than creating a new own data property. The classification [CWE-1321] Improperly Controlled Modification of Object Prototype Attributes describes this exact class of flaw.

Attack Vector

Exploitation requires attacker-controlled content loaded in a renderer that communicates with a preload script through contextBridge. The attacker sends a crafted object across the bridge whose keys include __proto__ with an attacker-controlled value. When the preload script reads a property that is not present as an own property, the lookup traverses the prototype chain and returns the poisoned value, giving the attacker influence over preload-side logic.

text

// Patch from Electron: shell/renderer/api/electron_api_context_bridge.cc
{
  v8::Context::Scope inner_destination_context_scope(
      destination_context);
-  proxy.Set(key, passed_value.ToLocalChecked());
+  // Use CreateDataProperty (not Set) so that a key named "__proto__"
+  // becomes an own data property instead of invoking the inherited
+  // Object.prototype.__proto__ setter and mutating the prototype.
+  v8::Local<v8::Value> proxied_value = passed_value.ToLocalChecked();
+  if (key->IsName()) {
+    std::ignore = proxy.GetHandle()->CreateDataProperty(
+        destination_context, key.As<v8::Name>(), proxied_value);
+  } else {
+    std::ignore = proxy.GetHandle()->CreateDataProperty(
+        destination_context, key.As<v8::Uint32>()->Value(),
+        proxied_value);
+  }
}

Source: Electron commit 17d5d264

Detection Methods for CVE-2026-70610

Indicators of Compromise

Preload scripts observing unexpected values for properties that were never set, particularly when accessed via bracket notation on objects received from renderer content.
Renderer-originating IPC messages or contextBridge calls containing objects whose keys include __proto__, constructor, or prototype.
Anomalous behavior of Electron applications after loading third-party or remote web content, such as unexpected API access paths inside preload code.

Detection Strategies

Inventory installed Electron-based desktop applications and identify versions below 39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.4.
Review preload scripts in owned applications for object-argument handlers that access properties without Object.hasOwn() or hasOwnProperty checks.
Instrument preload code during testing to log receipt of keys equal to __proto__ or constructor from the renderer side.

Monitoring Recommendations

Track new releases from the Electron GitHub Security Advisory GHSA-ff2p-hmqr-hxm4 and downstream vendor advisories for applications built on Electron.
Monitor endpoint process telemetry for Electron applications spawning unexpected child processes or accessing sensitive files after loading remote content.
Alert on outbound network connections from Electron applications to previously unseen domains after untrusted content is loaded.

How to Mitigate CVE-2026-70610

Immediate Actions Required

Upgrade Electron to 39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.4 or later on the corresponding release line.
Audit preload scripts for object argument handling and add explicit own-property checks using Object.hasOwn() before reading properties from untrusted objects.
Restrict preload APIs to accept primitive arguments where possible, rejecting object arguments from renderer content that cannot be strictly validated.

Patch Information

The fix replaces proxy.Set() with CreateDataProperty() in shell/renderer/api/electron_api_context_bridge.cc, ensuring that keys such as __proto__ become own data properties on the destination proxy rather than invoking the inherited prototype setter. Patched releases are available: v39.8.9, v40.9.2, v41.2.2, and v42.0.0-beta.4. The corresponding pull requests are PR #51083, PR #51084, PR #51085, and PR #51086.

Workarounds

Change contextBridge APIs to accept only primitive arguments such as strings, numbers, and booleans, avoiding object arguments from untrusted content entirely.
Guard every property read on renderer-supplied objects with Object.hasOwn(obj, key) or Object.prototype.hasOwnProperty.call(obj, key) before use.
Disable loading of untrusted or remote content in windows whose preload scripts expose sensitive APIs, and enforce a strict Content Security Policy.

bash

# Update Electron via npm to a patched release on your chosen line
npm install --save-dev electron@39.8.9
# or
npm install --save-dev electron@40.9.2
# or
npm install --save-dev electron@41.2.2