{"id":"EUVD-2026-53428","enisaUuid":"d7b7a30d-bfd1-32ac-a400-b84131a6c0ea","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.","datePublished":"Aug 5, 2026, 3:36:02 PM","dateUpdated":"Aug 5, 2026, 6:41:57 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp\nhttps://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c\n","aliases":"CVE-2026-70599\nGHSA-9pf5-hg6p-4pwp\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"6a6b567c-42dc-3f16-84f7-8d55ea671ffa","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.0.0-beta.1"},{"id":"7d536262-ea58-36af-914f-dc74c04c4321","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"40.0.0-alpha.1, \u003c 40.9.0"},{"id":"aa483787-713d-3ed7-81f7-13b62ca22556","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 39.8.7"},{"id":"eaa02150-07ac-3d51-8957-af924a722895","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"41.0.0-alpha.1, \u003c 41.2.0"}],"enisaIdVendor":[{"id":"81b4e304-8d17-3f05-8cd1-dd59a1001784","vendor":{"name":"electron"}}],"enisaIdVulnerability":[{"id":"2c548010-bc40-3dce-af71-94fe05251126","vulnerability":{"id":"CVE-2026-70599","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.","datePublished":"Aug 5, 2026, 3:36:02 PM","dateUpdated":"Aug 5, 2026, 6:41:57 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp\nhttps://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c\n","enisa_id":"EUVD-2026-53428\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Nov 3, 2026, 7:13:01 AM","vulnerabilityProduct":[{"id":"3879e6d0-6e00-3b1c-97f4-97f2cb75ee4a","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"41.0.0-alpha.1, \u003c 41.2.0"},{"id":"7efbb4e0-c9c9-3bf7-8306-76af8b5bf1e8","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 39.8.7"},{"id":"9ba8156a-0048-3d70-a37f-2b6fc4f0d5ef","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"40.0.0-alpha.1, \u003c 40.9.0"},{"id":"adcc8afd-dabf-346f-bbd9-d23abe65b4e2","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.0.0-beta.1"}],"vulnerabilityVendor":[{"id":"d47d8b41-1b97-3bb6-836e-467ddfe3bca6","vendor":{"name":"electron"}}]}},{"id":"6d4b62d4-63bc-3d62-ad72-2e0f8d47d6a0","vulnerability":{"id":"GHSA-9pf5-hg6p-4pwp","description":"Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin","datePublished":"Aug 5, 2026, 3:36:09 PM","dateUpdated":"Aug 5, 2026, 3:36:09 PM","baseScore":0.0,"references":"https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp\nhttps://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c\nhttps://github.com/electron/electron\n","enisa_id":"EUVD-2026-53428\n","aliases":"CVE-2026-70599\nGHSA-9pf5-hg6p-4pwp\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}