Electron: Sandboxed iframes can launch external protocol handlers

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-70612 · Microsoft / collected KEV context

EUVD-2026-53546

GHSA-p2rr-rvmm-c5fp

cve-program · CVE-2026-70612

• https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp
• https://github.com/electron/electron/pull/50961
• https://github.com/electron/electron/pull/50962
• https://github.com/electron/electron/pull/50963
• https://github.com/electron/electron/pull/50964
• https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5
• https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a
• https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39
• https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3
• https://github.com/electron/electron/releases/tag/v39.8.8
• https://github.com/electron/electron/releases/tag/v40.9.0
• https://github.com/electron/electron/releases/tag/v41.2.1
• https://github.com/electron/electron/releases/tag/v42.0.0-beta.3

euvd · EUVD-2026-53546

• https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp
• https://github.com/electron/electron/pull/50961
• https://github.com/electron/electron/pull/50962
• https://github.com/electron/electron/pull/50963
• https://github.com/electron/electron/pull/50964
• https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5
• https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a
• https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39
• https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3
• https://github.com/electron/electron/releases/tag/v39.8.8
• https://github.com/electron/electron/releases/tag/v40.9.0
• https://github.com/electron/electron/releases/tag/v41.2.1
• https://github.com/electron/electron/releases/tag/v42.0.0-beta.3

nvd · CVE-2026-70612

• https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5
• https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a
• https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39
• https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3
• https://github.com/electron/electron/pull/50961
• https://github.com/electron/electron/pull/50962
• https://github.com/electron/electron/pull/50963
• https://github.com/electron/electron/pull/50964
• https://github.com/electron/electron/releases/tag/v39.8.8
• https://github.com/electron/electron/releases/tag/v40.9.0
• https://github.com/electron/electron/releases/tag/v41.2.1
• https://github.com/electron/electron/releases/tag/v42.0.0-beta.3
• https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp

osv · GHSA-p2rr-rvmm-c5fp

• https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp
• https://github.com/electron/electron/pull/50961
• https://github.com/electron/electron/pull/50962
• https://github.com/electron/electron/pull/50963
• https://github.com/electron/electron/pull/50964
• https://github.com/electron/electron/commit/08b9d0a220e267d1a2402a44bdd01a2e9aa320b5
• https://github.com/electron/electron/commit/2764e4c35168855f614876051823db4f58a3714a
• https://github.com/electron/electron/commit/477dcf7afc6550715f9ec5e6f39ee38e5dd7bf39
• https://github.com/electron/electron/commit/c39e3d5687d57434c8d5fe814c5152efd2f631c3
• https://github.com/electron/electron
• https://github.com/electron/electron/releases/tag/v39.8.8
• https://github.com/electron/electron/releases/tag/v40.9.0
• https://github.com/electron/electron/releases/tag/v41.2.1
• https://github.com/electron/electron/releases/tag/v42.0.0-beta.3

No related operational record is retained in the current change model.