Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3, the DevTools reveal in file manager action could launch the target file rather than reveal it. An attacker with a separate means of running script inside the DevTools frontend, such as a malicious DevTools extension, could use showItemInFolder handling to execute native code outside the sandbox when DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions. This issue is fixed in 39.8.9, 40.9.2, 41.2.1, and 42.0.0-beta.3.
{
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70611.json"
}{
"source": [
"AFFECTED_FIELD",
"REFERENCES"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "39.8.9"
},
{
"introduced": "40.0.0-alpha.1"
},
{
"fixed": "40.9.2"
},
{
"introduced": "41.0.0-alpha.1"
},
{
"fixed": "41.2.1"
},
{
"introduced": "42.0.0-alpha.1"
},
{
"fixed": "42.0.0-beta.3"
}
]
}[
{
"digest": {
"length": 490.0,
"function_hash": "272553221120290705100734388975204268805"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/8ee008ad48671e179d1b8258879871709babfff3",
"signature_type": "Function",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc",
"function": "WebContents::SetHtmlApiFullscreen"
},
"signature_version": "v1",
"id": "CVE-2026-70611-12b8aaae"
},
{
"digest": {
"length": 230.0,
"function_hash": "335495857165609156618673963711778125613"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"signature_type": "Function",
"target": {
"file": "shell/common/node_bindings.cc",
"function": "NodeBindings::PrepareEmbedThread"
},
"signature_version": "v1",
"id": "CVE-2026-70611-1800f516"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"143002245638246471333529635618558180129",
"87254374132032139114365534698623754350",
"11119125669916178811372489011188001675",
"47756869188821518447231213625809964187",
"93257026073512559027355871798828351414",
"218028452189299593097413202899246287872",
"183068029428138372914989720700069525711",
"308851245949279309164196816991790929676",
"31261379427473256443513925469797872650",
"239834157187955226551023435735770245531",
"209278014513942064211214421943466322949",
"339486751927985252796988688125271721318",
"264232842545211780795404137247864205572",
"48121184404156055441108252716478252762",
"248893459056859965718260779231551849003"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de",
"signature_type": "Line",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"signature_version": "v1",
"id": "CVE-2026-70611-198e5c72"
},
{
"digest": {
"length": 110.0,
"function_hash": "185430718627347679945584946994237383614"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44",
"signature_type": "Function",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc",
"function": "OnOpenItemComplete"
},
"signature_version": "v1",
"id": "CVE-2026-70611-22fe5b05"
},
{
"digest": {
"length": 258.0,
"function_hash": "277451481604883474887185196191556635978"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771",
"signature_type": "Function",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc",
"function": "InspectableWebContents::ShowItemInFolder"
},
"signature_version": "v1",
"id": "CVE-2026-70611-48e38835"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"78781854782122480115110555473296009465",
"85235159336249612906165875906404449666",
"1704316639513390415735976250714279744",
"113907684004222154642197440622422302587",
"143767606140857763680209739100129142630",
"4085924828981225768250855636440738261",
"225171451748571715030534155824887162893"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"signature_type": "Line",
"target": {
"file": "shell/renderer/web_worker_observer.h"
},
"signature_version": "v1",
"id": "CVE-2026-70611-57b52b78"
},
{
"digest": {
"length": 387.0,
"function_hash": "312936031197874051122424604609405502091"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"signature_type": "Function",
"target": {
"file": "shell/renderer/electron_renderer_client.cc",
"function": "WorkerHasNodeIntegration"
},
"signature_version": "v1",
"id": "CVE-2026-70611-5b95a7b7"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"54273452830487816958455959416291135902",
"150838841557886732941326920803724059907",
"187193053411273359885271696371999659907",
"82352559318974630549796789741173066332",
"93257026073512559027355871798828351414",
"218028452189299593097413202899246287872",
"183068029428138372914989720700069525711",
"308851245949279309164196816991790929676",
"31261379427473256443513925469797872650",
"239834157187955226551023435735770245531",
"209278014513942064211214421943466322949",
"339486751927985252796988688125271721318",
"264232842545211780795404137247864205572",
"48121184404156055441108252716478252762",
"248893459056859965718260779231551849003"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322",
"signature_type": "Line",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"signature_version": "v1",
"id": "CVE-2026-70611-5e9f7a80"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"15682146902651291502359085377717075897",
"276527650456380695295071685428336688423",
"74027944338977948308663562070351154643",
"239644526509655375329227422095204640925"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/8ee008ad48671e179d1b8258879871709babfff3",
"signature_type": "Line",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
},
"signature_version": "v1",
"id": "CVE-2026-70611-60dfa0b4"
},
{
"digest": {
"length": 110.0,
"function_hash": "185430718627347679945584946994237383614"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de",
"signature_type": "Function",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc",
"function": "OnOpenItemComplete"
},
"signature_version": "v1",
"id": "CVE-2026-70611-649bac25"
},
{
"digest": {
"length": 110.0,
"function_hash": "185430718627347679945584946994237383614"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322",
"signature_type": "Function",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc",
"function": "OnOpenItemComplete"
},
"signature_version": "v1",
"id": "CVE-2026-70611-654eeee2"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"181071783244310257058064329267677076694",
"5027461540278883884050412617256461710",
"60769568555936644506704401730378580026",
"173554913096444702603929991313952798317",
"171861544910850727064273112957813351322",
"278561805371457837806036686687706808179",
"319733866987723972380498962027427482819",
"167790802028852509496855543624808582728",
"281192473332154818017269650951675126712",
"36006785812055659924337462307910151255",
"1987452759220617931843694366613336292",
"110957835605308068244844743801127670192",
"289188685885633929092171783072095745472",
"233728729546512825850116967691160756027",
"80471115868158490582536102517585941700",
"26445457947037061180633511719463488963",
"204216170143683025761414962069151401486",
"256261468441923426780354924930211343539",
"297861046669470619399386137944649646428",
"132286361734713122048445318086348267976",
"287682887706699586809510596569410602072",
"59807183127163105735084762179047477323",
"35380290097162963708124533410756648610",
"52821623261116292610299820597075751400",
"203510398599358724528265778445403700627",
"45456719825031413046069521659373285512",
"162708844452509370655099253954278088564",
"285370245058404002401879985041430015705",
"154287325913862402322922436474937300409",
"47023680300307831180557421574839680683",
"297416259260983873189667411442474688290",
"116248155252940593930965765782970634686",
"220731176874115143473590317327085460179"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"signature_type": "Line",
"target": {
"file": "shell/renderer/web_worker_observer.cc"
},
"signature_version": "v1",
"id": "CVE-2026-70611-701489b7"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"7425696483915813590925622265081019009",
"162046712020857118629126558135976734790",
"92849220484636534636691861165897381701",
"104929377092860514129450041127063921448",
"22901954470087552080075564987316073177",
"257155163527749956373331781193660117214"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"signature_type": "Line",
"target": {
"file": "shell/common/node_bindings.h"
},
"signature_version": "v1",
"id": "CVE-2026-70611-725db013"
},
{
"digest": {
"length": 258.0,
"function_hash": "277451481604883474887185196191556635978"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/10fb5b39c5287f70c4bbcab4c24197f3871ec322",
"signature_type": "Function",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc",
"function": "InspectableWebContents::ShowItemInFolder"
},
"signature_version": "v1",
"id": "CVE-2026-70611-7d0a3677"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"15379472016395151813521737791434764801",
"240745751385737148663127296570202669018",
"315480576635211094440994201899726368626",
"231159486855322497234381922999493114014",
"260750523761995806454040976606140949229",
"119043178018630465986613588375217023541",
"65678953020020734071465982322449808267",
"57029332843698437964589615419068849943",
"306686536922351287118942273020027152057",
"262023730804583887813591692612253692168",
"287980295681420195593293509150931926750",
"281516522866864782453933119264014373953",
"43437842152991809816333665656612483325",
"71269684503675198398244710657812238063",
"302538951462718332606744757341208824785"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"signature_type": "Line",
"target": {
"file": "shell/common/node_bindings.cc"
},
"signature_version": "v1",
"id": "CVE-2026-70611-95031a0a"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"306915714585107200138177519005047716742",
"202738649171510169947048201376979302762",
"106108923306789796560498188390735523050",
"91188692980459615942004994506495443684",
"276809917268728219266368939068023374136",
"66805753979719827856671148722276593226",
"278343193711332348590048592564096286059",
"134957147192935012748521602195074888659",
"154126548002421356203577241421082676903",
"243119622680965238274948998168655940058",
"331746083557283440693404465751998988685",
"191000051198320769827155946320617499018",
"161139293111368873884650433354026058156",
"83472740218079086180510666962973718680",
"338318026492936402743439412337230143542",
"11348387745004683631587600825162721634"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"signature_type": "Line",
"target": {
"file": "shell/renderer/electron_renderer_client.cc"
},
"signature_version": "v1",
"id": "CVE-2026-70611-9934d92d"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"143002245638246471333529635618558180129",
"87254374132032139114365534698623754350",
"11119125669916178811372489011188001675",
"47756869188821518447231213625809964187",
"93257026073512559027355871798828351414",
"218028452189299593097413202899246287872",
"183068029428138372914989720700069525711",
"308851245949279309164196816991790929676",
"31261379427473256443513925469797872650",
"239834157187955226551023435735770245531",
"209278014513942064211214421943466322949",
"339486751927985252796988688125271721318",
"264232842545211780795404137247864205572",
"48121184404156055441108252716478252762",
"248893459056859965718260779231551849003"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44",
"signature_type": "Line",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"signature_version": "v1",
"id": "CVE-2026-70611-aecd30ca"
},
{
"digest": {
"length": 110.0,
"function_hash": "185430718627347679945584946994237383614"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771",
"signature_type": "Function",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc",
"function": "OnOpenItemComplete"
},
"signature_version": "v1",
"id": "CVE-2026-70611-c40c9b25"
},
{
"digest": {
"length": 258.0,
"function_hash": "277451481604883474887185196191556635978"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/27bf1cae9274d5025684c7268496f435b7e06b44",
"signature_type": "Function",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc",
"function": "InspectableWebContents::ShowItemInFolder"
},
"signature_version": "v1",
"id": "CVE-2026-70611-c531e77a"
},
{
"digest": {
"length": 237.0,
"function_hash": "44438896590172206621274999957068632191"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/55ca037b117d4ffee403b31d0c1bc74b6ab938c0",
"signature_type": "Function",
"target": {
"file": "shell/common/node_bindings.cc",
"function": "NodeBindings::~NodeBindings"
},
"signature_version": "v1",
"id": "CVE-2026-70611-c612590a"
},
{
"digest": {
"length": 258.0,
"function_hash": "277451481604883474887185196191556635978"
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/7a1eb7e5585991b3726cedb890a6244f327f43de",
"signature_type": "Function",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc",
"function": "InspectableWebContents::ShowItemInFolder"
},
"signature_version": "v1",
"id": "CVE-2026-70611-d2fdc4ed"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"54273452830487816958455959416291135902",
"150838841557886732941326920803724059907",
"187193053411273359885271696371999659907",
"82352559318974630549796789741173066332",
"93257026073512559027355871798828351414",
"218028452189299593097413202899246287872",
"183068029428138372914989720700069525711",
"308851245949279309164196816991790929676",
"31261379427473256443513925469797872650",
"239834157187955226551023435735770245531",
"209278014513942064211214421943466322949",
"339486751927985252796988688125271721318",
"264232842545211780795404137247864205572",
"48121184404156055441108252716478252762",
"248893459056859965718260779231551849003"
]
},
"deprecated": false,
"source": "https://github.com/electron/electron/commit/1b8a298d629d5a642c816ea5f7505359de17b771",
"signature_type": "Line",
"target": {
"file": "shell/browser/ui/inspectable_web_contents.cc"
},
"signature_version": "v1",
"id": "CVE-2026-70611-e4007c7c"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70611.json"
"2026-08-07T22:16:27Z"