~ / search / GHSA-h7rp-cf8h-j98x

GHSA-h7rp-cf8h-j98x

Electron: Context isolation bypass via Function.prototype.bind hijack

Source: GitHub Advisory Database (reviewed) High CVE-2026-70601

Packages

EcosystemPackageAffectedFixed in
npm electron < 39.8.9 39.8.9
npm electron >= 40.0.0-alpha.1, < 40.9.2 40.9.2
npm electron >= 41.0.0-alpha.1, < 41.2.2 41.2.2
npm electron >= 42.0.0-alpha.1, < 42.0.0-beta.5 42.0.0-beta.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Apps that expose Promise-returning functions to web content via `contextBridge` may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with `nodeIntegration` enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via `contextBridge` — the standard pattern for wrapping `ipcRenderer.invoke` — in windows that load untrusted content. Apps that never load untrusted content in those windows are not affected. ### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ### Fixed Versions * `42.0.0-beta.5` * `41.2.2` * `40.9.2` * `39.8.9` ### For more information If you have any questions or comments about this advisory, email Electron at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.