CVE-2026-70611: Electron DevTools RCE Vulnerability

CVE-2026-70611 Overview

CVE-2026-70611 affects Electron, a framework for building cross-platform desktop applications using JavaScript, HTML, and CSS. The vulnerability resides in the DevTools "reveal in file manager" action, which incorrectly launches the target file instead of revealing it. An attacker who can already run script inside the DevTools frontend, such as through a malicious DevTools extension, can abuse showItemInFolder handling to execute native code outside the Electron sandbox. The issue impacts windows opened with DevTools that are exposed to untrusted content or untrusted DevTools extensions. Electron patched the flaw in versions 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.

Critical Impact
Attackers with script access inside DevTools can execute native code outside the Electron sandbox, breaking the application's primary isolation boundary.

Affected Products

Electron versions prior to 39.8.9
Electron versions prior to 40.9.2 and 41.2.1
Electron 42.0.0-beta versions prior to 42.0.0-beta.3

Discovery Timeline

2026-08-05 - CVE-2026-70611 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-70611

Vulnerability Analysis

Electron applications frequently expose DevTools during development or through user-triggered debugging flows. The DevTools frontend supports a "reveal in file manager" action, which is intended to open the operating system's file browser and highlight a target file. In vulnerable Electron builds, the underlying handler for showItemInFolder launches the target file directly rather than opening its parent folder in the file manager. This behavior is classified under [CWE-78] as an OS command execution weakness because the file path is passed to a native shell operation without the expected containment.

The flaw becomes exploitable when an attacker can inject script into the DevTools frontend, for example through a malicious DevTools extension or a window that already loads untrusted content with DevTools attached. From that position, the attacker calls the reveal handler with a path pointing to an executable or script. The operating system then launches that file outside the Electron renderer sandbox, giving the attacker native code execution with the user's privileges.

Root Cause

The root cause is incorrect handling of the reveal-in-file-manager action inside Electron's IPC bridge for showItemInFolder. Instead of instructing the OS shell to select the item within its containing folder, the handler invokes an operation that executes or opens the item itself. This turns a benign UI convenience into a sandbox escape primitive when script execution inside DevTools is possible.

Attack Vector

Exploitation requires local access, high attack complexity, high privileges, user interaction, and a scope change from the sandbox to the host. A typical chain begins with the victim installing or loading a malicious DevTools extension, or opening DevTools on a window that renders attacker-controlled content. The attacker then invokes the vulnerable IPC path with a file path chosen to execute native code. See the GitHub Security Advisory GHSA-f2r8-jv7c-xqmp for maintainer-authored technical details.

Detection Methods for CVE-2026-70611

Indicators of Compromise

Electron-based applications spawning unexpected child processes such as cmd.exe, powershell.exe, open, or xdg-open with paths to user-writable or temporary directories.
DevTools windows opened programmatically on renderers that host third-party or web-sourced content.
Installation or sideloading of unsigned DevTools extensions on developer or power-user endpoints.

Detection Strategies

Inventory installed Electron applications and correlate their embedded Electron runtime versions against the fixed releases 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
Alert on Electron parent processes launching executables from download folders, %TEMP%, or per-user application data paths.
Monitor for unusual invocations of shell.showItemInFolder behavior at the process-tree level, particularly when the "revealed" target is an executable rather than a document.

Monitoring Recommendations

Enable process-tree telemetry on developer workstations, where DevTools usage is most common.
Track loaded DevTools extensions and flag any not sourced from a controlled internal registry.
Capture command-line arguments for shell-launch primitives to identify attempts to open executables through the reveal action.

How to Mitigate CVE-2026-70611

Immediate Actions Required

Upgrade all Electron applications to 39.8.9, 40.9.2, 41.2.1, or 42.0.0-beta.3 or later, matching the appropriate release branch.
Audit shipped applications for renderers that expose DevTools while loading untrusted content and disable DevTools in production builds.
Restrict installation of DevTools extensions on managed endpoints, particularly for developers who handle third-party code.

Patch Information

Electron released fixes in the following builds: v39.8.9, v40.9.2, v41.2.1, and v42.0.0-beta.3. The corrective changes are visible in the upstream pull requests #50937, #50938, #51114, and #51115. Application vendors that embed Electron must rebuild and redistribute their applications with the patched runtime.

Workarounds

Disable DevTools entirely in production by setting devTools: false in the webPreferences of every BrowserWindow that may load untrusted content.
Refuse to load unsigned or third-party DevTools extensions in enterprise deployments through application configuration or code review.
Isolate untrusted content in dedicated renderers that never have DevTools attached, keeping the reveal action out of reach of attacker-controlled script.

bash

# Example hardening in an Electron main process
const win = new BrowserWindow({
  webPreferences: {
    devTools: false,
    sandbox: true,
    contextIsolation: true,
    nodeIntegration: false
  }
});