{"uuid": "26869fc7-f12f-4dac-b7ab-4d55ed35a0d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-p2rr-rvmm-c5fp", "type": "seen", "source": "https://gist.github.com/alon710/665009967811310873cc6bc149b1a673", "content": "# CVE-2026-70612: CVE-2026-70612: Iframe Sandbox Escape and Host Protocol Launch in Electron\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70612\n\n## Summary\nImproper access control in Electron versions prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 allowed sandboxed iframes to bypass sandbox restrictions and trigger external application protocols on the host operating system. The application's custom permission handler was also not provided with the frame's sandbox state, preventing effective validation of the request context.\n\n## TL;DR\nA validation flaw in Electron allowed sandboxed iframes to bypass security restrictions and launch OS-registered external protocol handlers without authorization.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284 (Improper Access Control)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.4\n- **EPSS Score**: Not indexed\n- **Impact**: Medium (Scope Change, potential host-level command execution)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed in CISA KEV\n\n## Affected Systems\n\n- Electron applications rendering untrusted content in sandboxed iframes without rigorous custom permission handlers.\n- **electron**: < 39.8.8 (Fixed in: `39.8.8`)\n- **electron**: >= 40.0.0-alpha.1 < 40.9.0 (Fixed in: `40.9.0`)\n- **electron**: >= 41.0.0-alpha.1 < 41.2.1 (Fixed in: `41.2.1`)\n- **electron**: >= 42.0.0-alpha.1 < 42.0.0-beta.3 (Fixed in: `42.0.0-beta.3`)\n\n## Mitigation\n\n- Upgrade the Electron framework to patched versions to ensure proper validation of iframe sandbox flags.\n- Configure setPermissionRequestHandler to manually inspect and filter openExternal permission requests.\n- Implement strong Content Security Policies (CSP) to restrict allowed navigation endpoints.\n\n**Remediation Steps:**\n1. Identify the current Electron version used in package.json.\n2. Update package.json dependencies to set electron >= 39.8.8, >= 40.9.0, >= 41.2.1, or >= 42.0.0-beta.3.\n3. Install dependencies and rebuild the application binary.\n4. Review custom setPermissionRequestHandler configurations and enforce strict origin-based blacklists for openExternal actions.\n\n## References\n\n- [Electron Security Advisory (GHSA-p2rr-rvmm-c5fp)](https://github.com/electron/electron/security/advisories/GHSA-p2rr-rvmm-c5fp)\n- [Chromium Status: Restriction of navigation to custom protocols from sandboxed iframes](https://chromestatus.com/feature/5680742077038592)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70612) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T18:31:28.606600Z"}