Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
{
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70605.json",
"cwe_ids": [
"CWE-918"
]
}{
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "39.8.8"
},
{
"introduced": "40.0.0-alpha.1"
},
{
"fixed": "40.9.0"
},
{
"introduced": "41.0.0-alpha.1"
},
{
"fixed": "41.2.1"
},
{
"introduced": "42.0.0-alpha.1"
},
{
"fixed": "42.0.0-beta.3"
}
],
"source": "AFFECTED_FIELD"
}[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 490.0,
"function_hash": "272553221120290705100734388975204268805"
},
"id": "CVE-2026-70605-12b8aaae",
"signature_type": "Function",
"source": "https://github.com/electron/electron/commit/8ee008ad48671e179d1b8258879871709babfff3",
"target": {
"function": "WebContents::SetHtmlApiFullscreen",
"file": "shell/browser/api/electron_api_web_contents.cc"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"15682146902651291502359085377717075897",
"276527650456380695295071685428336688423",
"74027944338977948308663562070351154643",
"239644526509655375329227422095204640925"
]
},
"id": "CVE-2026-70605-60dfa0b4",
"signature_type": "Line",
"source": "https://github.com/electron/electron/commit/8ee008ad48671e179d1b8258879871709babfff3",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
}
}
]
"2026-08-07T22:16:25Z"
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70605.json"