~ / search / GHSA-r4w5-6pfg-jxp5

GHSA-r4w5-6pfg-jxp5

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-70606

Packages

EcosystemPackageAffectedFixed in
npm electron >= 43.0.0-alpha.1, < 43.0.0 43.0.0
npm electron >= 42.0.0-alpha.1, < 42.5.1 42.5.1
npm electron >= 41.0.0-alpha.1, < 41.9.1 41.9.1
npm electron >= 40.0.0-alpha.1, < 40.10.6 40.10.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When a custom protocol handler returned a `ProtocolResponse` with a `url` and no `session`, Electron made the upstream request through `defaultSession` instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use `ProtocolResponse.url`, omit `ProtocolResponse.session`, and rely on separate sessions to isolate content are affected. Apps that set an explicit `session`, or that do not isolate content across sessions, are not affected. ### Workarounds Set `ProtocolResponse.session` explicitly so the request uses the intended session's cache. ### Fixed Versions * `43.0.0` * `42.5.1` * `41.9.1` * `40.10.6` ### For more information If you have any questions or comments about this advisory, email Electron at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.