Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code despite context isolation being enabled. Apps are only affected if their preload code accepts object arguments from untrusted content and reads properties from them without own-property checks, while apps that only accept primitive arguments or validate object arguments are not affected. This issue is fixed in 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-1321"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70610.json"
}{
"source": [
"AFFECTED_FIELD",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "39.8.9"
},
{
"introduced": "40.0.0-alpha.1"
},
{
"fixed": "40.9.2"
},
{
"introduced": "41.0.0-alpha.1"
},
{
"fixed": "41.2.2"
},
{
"introduced": "42.0.0-alpha.1"
},
{
"fixed": "42.0.0-beta.4"
}
]
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70610.json"
[
{
"source": "https://github.com/electron/electron/commit/f258998fcb1ac18acf09c97b93d66bc0aa9e13c4",
"id": "CVE-2026-70610-0e039141",
"signature_version": "v1",
"digest": {
"line_hashes": [
"297143061322844905834970150272697208024",
"337253177063287427580752249830366309613",
"174134956044823243098170964890132302174",
"175323748162881791648083077779682608125"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/browser/native_window.h"
}
},
{
"source": "https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55",
"id": "CVE-2026-70610-14041dc3",
"signature_version": "v1",
"digest": {
"line_hashes": [
"37496508633971958526306934771751251531",
"177652323808086512329980422904069536643",
"158742139294923506284685743376643869041",
"68964493757546551160263132659976718441"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/renderer/api/electron_api_context_bridge.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"id": "CVE-2026-70610-1800f516",
"signature_version": "v1",
"digest": {
"function_hash": "335495857165609156618673963711778125613",
"length": 230.0
},
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "shell/common/node_bindings.cc",
"function": "NodeBindings::PrepareEmbedThread"
}
},
{
"source": "https://github.com/electron/electron/commit/f258998fcb1ac18acf09c97b93d66bc0aa9e13c4",
"id": "CVE-2026-70610-1883c70c",
"signature_version": "v1",
"digest": {
"function_hash": "175537426368132843324939778809733603966",
"length": 139.0
},
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "shell/browser/native_window.cc",
"function": "NativeWindow::NotifyWindowAlwaysOnTopChanged"
}
},
{
"source": "https://github.com/electron/electron/commit/f258998fcb1ac18acf09c97b93d66bc0aa9e13c4",
"id": "CVE-2026-70610-1a25134e",
"signature_version": "v1",
"digest": {
"function_hash": "235875883491734434398752884199802050294",
"length": 580.0
},
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "shell/browser/native_window_views.cc",
"function": "NativeWindowViews::SetAlwaysOnTop"
}
},
{
"source": "https://github.com/electron/electron/commit/f258998fcb1ac18acf09c97b93d66bc0aa9e13c4",
"id": "CVE-2026-70610-1c13f842",
"signature_version": "v1",
"digest": {
"line_hashes": [
"158532924538806675864891109745325953786",
"209556235468344796156541935799408322993",
"16018316259909466101224965933692813397",
"208255780218814850169964432612584142839",
"335748032988123858534841348429465348682"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/browser/native_window.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/f258998fcb1ac18acf09c97b93d66bc0aa9e13c4",
"id": "CVE-2026-70610-1e0a8084",
"signature_version": "v1",
"digest": {
"line_hashes": [
"32681632024196028854111777292420002214",
"212984780224930917582686615399287711174",
"194729549769098551218851634972674306138",
"144530396718664739445273680960300668036",
"93416211132789364794134602688083935259",
"264912143108452090312033157343123507700",
"49805563996242118101431619296115490372",
"287738452494263754551839721943684527537",
"160167866770386745001592762679014058147",
"255167098463956743854203683357767471257",
"231940941402787880290495734538121958799",
"141324807277377317460574614383508119809",
"190382202121833445525202549924634819096",
"274044270313441898321731904553951247733",
"144964004276360826381761978970898859967",
"140915940730047303044059617209897169731"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/browser/native_window_views.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/f258998fcb1ac18acf09c97b93d66bc0aa9e13c4",
"id": "CVE-2026-70610-3269dee2",
"signature_version": "v1",
"digest": {
"function_hash": "164049981563561766907155324015342289993",
"length": 108.0
},
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "shell/browser/api/electron_api_base_window.cc",
"function": "BaseWindow::OnWindowAlwaysOnTopChanged"
}
},
{
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"id": "CVE-2026-70610-57b52b78",
"signature_version": "v1",
"digest": {
"line_hashes": [
"78781854782122480115110555473296009465",
"85235159336249612906165875906404449666",
"1704316639513390415735976250714279744",
"113907684004222154642197440622422302587",
"143767606140857763680209739100129142630",
"4085924828981225768250855636440738261",
"225171451748571715030534155824887162893"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/renderer/web_worker_observer.h"
}
},
{
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"id": "CVE-2026-70610-5b95a7b7",
"signature_version": "v1",
"digest": {
"function_hash": "312936031197874051122424604609405502091",
"length": 387.0
},
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "shell/renderer/electron_renderer_client.cc",
"function": "WorkerHasNodeIntegration"
}
},
{
"source": "https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713",
"id": "CVE-2026-70610-60e95062",
"signature_version": "v1",
"digest": {
"line_hashes": [
"37496508633971958526306934771751251531",
"177652323808086512329980422904069536643",
"158742139294923506284685743376643869041",
"68964493757546551160263132659976718441"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/renderer/api/electron_api_context_bridge.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"id": "CVE-2026-70610-701489b7",
"signature_version": "v1",
"digest": {
"line_hashes": [
"181071783244310257058064329267677076694",
"5027461540278883884050412617256461710",
"60769568555936644506704401730378580026",
"173554913096444702603929991313952798317",
"171861544910850727064273112957813351322",
"278561805371457837806036686687706808179",
"319733866987723972380498962027427482819",
"167790802028852509496855543624808582728",
"281192473332154818017269650951675126712",
"36006785812055659924337462307910151255",
"1987452759220617931843694366613336292",
"110957835605308068244844743801127670192",
"289188685885633929092171783072095745472",
"233728729546512825850116967691160756027",
"80471115868158490582536102517585941700",
"26445457947037061180633511719463488963",
"204216170143683025761414962069151401486",
"256261468441923426780354924930211343539",
"297861046669470619399386137944649646428",
"132286361734713122048445318086348267976",
"287682887706699586809510596569410602072",
"59807183127163105735084762179047477323",
"35380290097162963708124533410756648610",
"52821623261116292610299820597075751400",
"203510398599358724528265778445403700627",
"45456719825031413046069521659373285512",
"162708844452509370655099253954278088564",
"285370245058404002401879985041430015705",
"154287325913862402322922436474937300409",
"47023680300307831180557421574839680683",
"297416259260983873189667411442474688290",
"116248155252940593930965765782970634686",
"220731176874115143473590317327085460179"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/renderer/web_worker_observer.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"id": "CVE-2026-70610-725db013",
"signature_version": "v1",
"digest": {
"line_hashes": [
"7425696483915813590925622265081019009",
"162046712020857118629126558135976734790",
"92849220484636534636691861165897381701",
"104929377092860514129450041127063921448",
"22901954470087552080075564987316073177",
"257155163527749956373331781193660117214"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/common/node_bindings.h"
}
},
{
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"id": "CVE-2026-70610-95031a0a",
"signature_version": "v1",
"digest": {
"line_hashes": [
"15379472016395151813521737791434764801",
"240745751385737148663127296570202669018",
"315480576635211094440994201899726368626",
"231159486855322497234381922999493114014",
"260750523761995806454040976606140949229",
"119043178018630465986613588375217023541",
"65678953020020734071465982322449808267",
"57029332843698437964589615419068849943",
"306686536922351287118942273020027152057",
"262023730804583887813591692612253692168",
"287980295681420195593293509150931926750",
"281516522866864782453933119264014373953",
"43437842152991809816333665656612483325",
"71269684503675198398244710657812238063",
"302538951462718332606744757341208824785"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/common/node_bindings.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"id": "CVE-2026-70610-9934d92d",
"signature_version": "v1",
"digest": {
"line_hashes": [
"306915714585107200138177519005047716742",
"202738649171510169947048201376979302762",
"106108923306789796560498188390735523050",
"91188692980459615942004994506495443684",
"276809917268728219266368939068023374136",
"66805753979719827856671148722276593226",
"278343193711332348590048592564096286059",
"134957147192935012748521602195074888659",
"154126548002421356203577241421082676903",
"243119622680965238274948998168655940058",
"331746083557283440693404465751998988685",
"191000051198320769827155946320617499018",
"161139293111368873884650433354026058156",
"83472740218079086180510666962973718680",
"338318026492936402743439412337230143542",
"11348387745004683631587600825162721634"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/renderer/electron_renderer_client.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"id": "CVE-2026-70610-c612590a",
"signature_version": "v1",
"digest": {
"function_hash": "44438896590172206621274999957068632191",
"length": 237.0
},
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "shell/common/node_bindings.cc",
"function": "NodeBindings::~NodeBindings"
}
},
{
"source": "https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737",
"id": "CVE-2026-70610-c74a758f",
"signature_version": "v1",
"digest": {
"line_hashes": [
"37496508633971958526306934771751251531",
"177652323808086512329980422904069536643",
"158742139294923506284685743376643869041",
"68964493757546551160263132659976718441"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/renderer/api/electron_api_context_bridge.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd",
"id": "CVE-2026-70610-f07fcb64",
"signature_version": "v1",
"digest": {
"line_hashes": [
"37496508633971958526306934771751251531",
"177652323808086512329980422904069536643",
"158742139294923506284685743376643869041",
"68964493757546551160263132659976718441"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/renderer/api/electron_api_context_bridge.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/f258998fcb1ac18acf09c97b93d66bc0aa9e13c4",
"id": "CVE-2026-70610-f0b3d59c",
"signature_version": "v1",
"digest": {
"line_hashes": [
"92849374854637147246105720182829639226",
"220138573402404882654785545302197459784",
"240900997348809292534638921737574361447",
"92469416389970344084701840046232696099",
"193119292134313869869910292308270569967"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/browser/api/electron_api_base_window.cc"
}
},
{
"source": "https://github.com/electron/electron/commit/f258998fcb1ac18acf09c97b93d66bc0aa9e13c4",
"id": "CVE-2026-70610-fbbb1a28",
"signature_version": "v1",
"digest": {
"line_hashes": [
"96982260339270210078963679551085392825",
"323966903023029329670109153492442968250",
"163234035437462056817230330839474459202",
"195218009450810256294743230972127756348"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/browser/api/electron_api_base_window.h"
}
},
{
"source": "https://github.com/electron/electron/commit/f258998fcb1ac18acf09c97b93d66bc0aa9e13c4",
"id": "CVE-2026-70610-fd592ede",
"signature_version": "v1",
"digest": {
"line_hashes": [
"131073759349258865131032617504118855829",
"30236810799830723479905700523738128374",
"173083436180101611549606615733650204133",
"273308299218658311700316020648291531736"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "shell/browser/native_window_observer.h"
}
}
]
"2026-08-08T09:11:58Z"