Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools() was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js, including when untrusted input reaches the mode argument of openDevTools() or untrusted content calls openDevTools() on a webview it embeds. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-116",
"CWE-94"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70609.json"
}{
"source": [
"AFFECTED_FIELD",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "39.8.7"
},
{
"introduced": "40.0.0-alpha.1"
},
{
"fixed": "40.9.0"
},
{
"introduced": "41.0.0-alpha.1"
},
{
"fixed": "41.2.0"
},
{
"introduced": "42.0.0-alpha.1"
},
{
"fixed": "42.0.0-beta.1"
}
]
}"2026-08-07T22:16:28Z"
[
{
"target": {
"function": "InspectableWebContents::SetDockState",
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"length": 171.0,
"function_hash": "42915916939393957199987600590846622759"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70609-1953096e",
"source": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1"
},
{
"target": {
"function": "InspectableWebContents::LoadCompleted",
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"length": 1328.0,
"function_hash": "19609003299816436114474962167457190555"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70609-258ad6fd",
"source": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b"
},
{
"target": {
"function": "InspectableWebContents::SetDockState",
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"length": 171.0,
"function_hash": "42915916939393957199987600590846622759"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70609-2b646aa4",
"source": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b"
},
{
"target": {
"function": "InspectableWebContents::LoadCompleted",
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"length": 1328.0,
"function_hash": "19609003299816436114474962167457190555"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70609-46122302",
"source": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1"
},
{
"target": {
"function": "InspectableWebContents::LoadCompleted",
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"length": 1328.0,
"function_hash": "19609003299816436114474962167457190555"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70609-8ec8e1df",
"source": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba"
},
{
"target": {
"function": "InspectableWebContents::SetDockState",
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"length": 171.0,
"function_hash": "42915916939393957199987600590846622759"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70609-95bfabb4",
"source": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba"
},
{
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"line_hashes": [
"250841091437351350423712114909758015524",
"7636811402120052508202410916157472793",
"88666931209530017057820681570381311739",
"186250394074743254146859972018157747639",
"48682887109136375304060172038523170777",
"28577345163468704738147178195569111185",
"334120322276181969006937226896424344588",
"13544381707351129539719937438530231296",
"235235758221241608618900629362880997950",
"85746165768139548792624352376782581254",
"21000111140543838885386837413903322725",
"257664887411636851054486403124133510598",
"216763352277246769297467783282461451670",
"243950412395756915125307120081634625442",
"181744195957580636193932836811505397489"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70609-aaf2d940",
"source": "https://github.com/electron/electron/commit/04614eed17986bddc43eb509ec870424ee6a47d1"
},
{
"target": {
"function": "InspectableWebContents::LoadCompleted",
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"length": 1328.0,
"function_hash": "19609003299816436114474962167457190555"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70609-bde3637c",
"source": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce"
},
{
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"line_hashes": [
"250841091437351350423712114909758015524",
"7636811402120052508202410916157472793",
"260279017135252415441280593199951949958",
"283192214425928426642558083837383394539",
"48682887109136375304060172038523170777",
"28577345163468704738147178195569111185",
"334120322276181969006937226896424344588",
"13544381707351129539719937438530231296",
"235235758221241608618900629362880997950",
"85746165768139548792624352376782581254",
"21000111140543838885386837413903322725",
"257664887411636851054486403124133510598",
"216763352277246769297467783282461451670",
"243950412395756915125307120081634625442",
"181744195957580636193932836811505397489"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70609-caaf0d4e",
"source": "https://github.com/electron/electron/commit/2046ae87731d80a7b535512ae19acb529e10e33b"
},
{
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"line_hashes": [
"250841091437351350423712114909758015524",
"7636811402120052508202410916157472793",
"88666931209530017057820681570381311739",
"186250394074743254146859972018157747639",
"48682887109136375304060172038523170777",
"28577345163468704738147178195569111185",
"334120322276181969006937226896424344588",
"13544381707351129539719937438530231296",
"235235758221241608618900629362880997950",
"85746165768139548792624352376782581254",
"21000111140543838885386837413903322725",
"257664887411636851054486403124133510598",
"216763352277246769297467783282461451670",
"243950412395756915125307120081634625442",
"181744195957580636193932836811505397489"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70609-cb38d677",
"source": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce"
},
{
"target": {
"function": "InspectableWebContents::SetDockState",
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"length": 171.0,
"function_hash": "42915916939393957199987600590846622759"
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2026-70609-f7b2cfbe",
"source": "https://github.com/electron/electron/commit/969741f9f847c5c583f6bbc63ca22549dbd954ce"
},
{
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"digest": {
"line_hashes": [
"250841091437351350423712114909758015524",
"7636811402120052508202410916157472793",
"88666931209530017057820681570381311739",
"186250394074743254146859972018157747639",
"48682887109136375304060172038523170777",
"28577345163468704738147178195569111185",
"334120322276181969006937226896424344588",
"13544381707351129539719937438530231296",
"235235758221241608618900629362880997950",
"85746165768139548792624352376782581254",
"21000111140543838885386837413903322725",
"257664887411636851054486403124133510598",
"216763352277246769297467783282461451670",
"243950412395756915125307120081634625442",
"181744195957580636193932836811505397489"
],
"threshold": 0.9
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2026-70609-fc3353e7",
"source": "https://github.com/electron/electron/commit/efc4d3c6b6f1c04f658ca0d9d2512dcfe78eb7ba"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70609.json"