Electron CVE-2026-70601

Exploitation requires two simultaneous conditions: (1) the Electron app must expose at least one Promise-returning function via contextBridge.exposeInMainWorld - the standard pattern for wrapping ipcRenderer.invoke - and (2) that same renderer window must load untrusted web content (e.g., remote URLs, user-supplied content, or third-party iframes). Apps that exclusively load local, first-party, trusted content in windows with contextBridge APIs are not affected. Exploitation is limited to the web content context: the attacker must be able to execute arbitrary JavaScript within the renderer (e.g., via a malicious page the app navigates to, or via XSS). Post-exploitation impact is bounded by the preload script's capabilities; escalation to Node.js occurs only in renderers where nodeIntegration is enabled or the Electron sandbox is not enforced, which are non-default but common configurations in older apps. Authentication to the system is not required (PR:N in CVSS), but the attacker must control content loaded by the renderer.

The NVD CVSS score of 7.5 (High) is driven by the scope-change flag (S:C) and high confidentiality impact (C:H), which accurately reflect that a successful exploit crosses a security boundary and grants access to a more privileged context. Attack Complexity is rated High (AC:H), consistent with the requirement that the app must be specifically configured to expose Promise-returning functions via contextBridge AND load untrusted content - both conditions must hold simultaneously. No privileges are required from the attacker (PR:N) and no user interaction is needed beyond the app's normal operation. There is no EPSS score or KEV listing in the provided data, indicating no confirmed active exploitation at time of analysis, and no public POC has been identified. Despite AC:H, real-world risk is elevated because the vulnerable pattern (wrapping ipcRenderer.invoke with contextBridge) is the canonical Electron security recommendation, meaning many production apps are likely configured this way. The S:C scope change is the most operationally significant signal: in apps without sandboxing or with nodeIntegration, this becomes a full Node.js code execution primitive. The A:N (no availability impact) reflects that this is primarily a privilege escalation/information disclosure path rather than a crash vector.

An attacker serves a malicious webpage loaded within a renderer window of an Electron application that exposes ipcRenderer.invoke wrappers via contextBridge - for example, a desktop app with an embedded browser pane or one that loads remote URLs. The malicious page overrides Function.prototype.bind before the contextBridge Promise handler executes, causing Electron's internal marshalling to leak a reference to the preload world's JS context. The attacker's code then traverses that reference to call any function the preload script exposes, including arbitrary IPC calls; in apps with nodeIntegration enabled or sandboxing disabled, this escalates to full Node.js execution on the host. No public POC has been confirmed at time of analysis.