Electron CVE-2026-70606

Exploitation requires three simultaneous application-level conditions confirmed by the vendor advisory: (1) the Electron application must register a custom protocol handler that returns a ProtocolResponse containing a url field; (2) that ProtocolResponse must omit the session field, either by design or developer oversight; and (3) the application must rely on Electron session partitions to enforce a security isolation boundary between content, users, or tenants. The CVSS vector additionally imposes AC:H (specific cache-hit timing alignment across sessions required) and UI:R (victim must interact with the application to trigger the protocol response). What limits exploitation: applications that explicitly set ProtocolResponse.session are fully protected; applications that do not use session partitions for security boundaries are not affected; and the AC:H requirement means exploitation cannot be blindly automated. There is no requirement for network adjacency or physical access beyond triggering the protocol handler through the Electron application's rendering context.

The CVSS 3.1 score of 5.9 (Medium) is well-calibrated: AV:N indicates the triggering pathway can involve network-fetched resources, but AC:H reflects that exploitation requires both a specific application architecture and a cache-hit timing alignment across session partitions - not a trivially repeatable condition. UI:R further constrains the attack surface to scenarios where victim interaction is required. There is no CISA KEV listing confirming active exploitation, and no public proof-of-concept has been identified in the provided intelligence. EPSS data was not supplied, limiting probabilistic exploitation estimate. The real-world risk is highly conditional: only Electron apps that simultaneously use ProtocolResponse.url, omit ProtocolResponse.session, and rely on session partition isolation for a security guarantee are actually exposed. Apps explicitly setting ProtocolResponse.session, or not employing session partitions for security, are entirely unaffected per the vendor advisory. Despite the moderate CVSS, the C:H impact is meaningful for affected apps - full disclosure of session-scoped cached data (potentially authenticated API responses, cookies, or sensitive content) across tenant or user boundaries is a serious breach of the application's intended isolation model.

An attacker targeting a multi-tenant Electron desktop application that isolates tenant data across separate session partitions could register or influence a custom protocol handler that returns a ProtocolResponse.url without an explicit session. By inducing a victim user to interact with the application in a way that triggers a cross-session protocol response, the attacker could cause a response cached in defaultSession to be served into an isolated partition - exposing cached authenticated API responses, cookies, or sensitive content belonging to another session. No public proof-of-concept has been identified, and the high attack complexity (AC:H) and required user interaction (UI:R) mean this is not a trivially automated attack.