What is the CVSS score of CVE-2026-70599?

CVE-2026-70599 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-70599?

Yes, a patch is available for CVE-2026-70599. Update the affected software to the latest version immediately.

Electron CVE-2026-70599

EUVD-2026-53428 MEDIUM

Origin Validation Error (CWE-346)

2026-08-05 https://github.com/electron/electron

GHSA-9pf5-hg6p-4pwp

Information Disclosure

5.9

CVSS 3.1 · Vendor: https://github.com/electron/electron

Severity by source

Vendor (https://github.com/electron/electron) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

AC:H reflects three required preconditions; C:H covers camera, microphone, and serial device streams; no integrity or availability impact applies.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/electron/electron).

CVSS VectorVendor: https://github.com/electron/electron

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 16:06 vuln.today

Analysis Generated

Aug 05, 2026 - 16:06 vuln.today

CVE Published

Aug 05, 2026 - 15:36 github-advisory

MEDIUM 5.9

DescriptionCVE.org

Impact

For serial-port and media (camera / microphone) permission checks made from an iframe, the requestingOrigin passed to session.setPermissionCheckHandler was the top-level frame's origin rather than the requesting frame's. Origin-based handler logic could therefore grant a cross-origin iframe device access intended only for the top-level origin.

Apps are only affected if they use setPermissionCheckHandler with origin-based logic and embed cross-origin iframes with delegated device permissions. Apps that base the decision on details.securityOrigin, or that do not embed such iframes, are not affected.

Workarounds

Check details.securityOrigin instead of requestingOrigin for these permissions, or do not delegate device permissions to untrusted iframes.

Fixed Versions

42.0.0-beta.1
41.2.0
40.9.0
39.8.7

For more information

If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org)

AnalysisAI

Electron's permission check handler incorrectly exposes cross-origin iframes to unauthorized camera, microphone, and serial port access by passing the top-level frame's origin as requestingOrigin instead of the requesting iframe's own origin. Applications implementing session.setPermissionCheckHandler with origin-based grant logic that also embed cross-origin iframes with delegated device permissions are affected - the handler is deceived into approving the iframe's request as if it came from the trusted top-level origin. No public exploit code exists and CISA KEV listing is not confirmed; the CVSS score of 5.9 with AC:H accurately reflects the specific multi-condition deployment pattern required for exploitation.

Technical ContextAI

The root cause (CWE-346, Origin Validation Error) lies in Electron's C++ permission-handling layer within shell/browser/web_contents_permission_helper.cc. Prior to the fix, CheckMediaAccessPermission and CheckSerialAccessPermission resolved the permission principal by calling web_contents_->GetPrimaryMainFrame() and web_contents_->GetLastCommittedURL() - always returning the top-level WebContents frame regardless of which RenderFrameHost actually initiated the permission request. The fix (commit 0cbdf2f) threads the requesting RenderFrameHost* through the entire permission check chain (CheckPermission, CheckMediaAccessPermission, CheckSerialAccessPermission) so that requesting_frame->GetLastCommittedOrigin().GetURL() is used, correctly identifying the iframe's security principal. Affected product: pkg:npm/electron across all release branches.

RemediationAI

Upgrade Electron to a patched release matching your current branch: v39.8.7, v40.9.0, v41.2.0, or v42.0.0-beta.1. The upstream code fix is in commit 0cbdf2f0375466d701aa393c92e0ec29eb89ea6c (https://github.com/electron/electron/commit/0cbdf2f0375466d701aa393c92e0ec29eb89ea6c). If an immediate upgrade is not feasible, the vendor-documented workaround is to replace all references to requestingOrigin in setPermissionCheckHandler callbacks with details.securityOrigin, which correctly reflects the requesting iframe's origin and is not affected by this bug - this change is backward compatible and has no known side effects. Alternatively, removing delegated device permissions from cross-origin iframes (by eliminating allow="camera; microphone" or serial Permissions Policy attributes) eliminates the attack surface entirely without requiring an Electron version change, though it also removes the intended iframe device access functionality. Advisory: https://github.com/electron/electron/security/advisories/GHSA-9pf5-hg6p-4pwp.