What is the CVSS score of EUVD-2026-53433?

EUVD-2026-53433 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Electron are affected by EUVD-2026-53433?

Electron-based applications used in enterprise environments can be compromised through web content injection, allowing attackers to steal data and gain unauthorized system access.. A patch is available.

How to fix or mitigate EUVD-2026-53433?

Within 24 hours, inventory all Electron-based applications in production and identify which versions are deployed, prioritizing those that load remote or untrusted content. Within 7 days, apply vendor patches across all active Electron version lines to all affected applications and conduct basic smoke testing. Within 30 days, complete comprehensive verification that the security isolation is restored and no regressions were introduced in patched applications.

Electron EUVD-2026-53433

| CVE-2026-70601 HIGH

Protection Mechanism Failure (CWE-693)

2026-08-05 https://github.com/electron/electron

GHSA-h7rp-cf8h-j98x

Authentication Bypass Node.js Microsoft

7.5

CVSS 3.1 · Vendor: https://github.com/electron/electron

Severity by source

Vendor (https://github.com/electron/electron) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.5 HIGH

AV:N for network-delivered malicious web content; AC:H for dual-condition requirement; S:C and C:H for preload context escape; I:L for IPC call abuse; no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (https://github.com/electron/electron).

CVSS VectorVendor: https://github.com/electron/electron

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 05, 2026 - 17:02 EUVD

Source Code Evidence Fetched

Aug 05, 2026 - 16:06 vuln.today

Analysis Generated

Aug 05, 2026 - 16:06 vuln.today

CVE Published

Aug 05, 2026 - 15:46 github-advisory

HIGH 7.5

DescriptionCVE.org

Impact

Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access.

Apps are affected if they expose Promise-returning functions via contextBridge - the standard pattern for wrapping ipcRenderer.invoke - in windows that load untrusted content. Apps that never load untrusted content in those windows are not affected.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

42.0.0-beta.5
41.2.2
40.9.2
39.8.9

For more information

If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org)

Articles & Coverage 1

News 4 New Node.js Vulnerabilities - 4 High Severity Patched Aug 06, 2026

AnalysisAI

Context isolation bypass in Electron allows untrusted web content loaded by an Electron app to escape the contextBridge security boundary and access the isolated preload world - and potentially Node.js - by hijacking Function.prototype.bind on exposed Promise-returning functions. The vulnerability (CVSS 7.5, S:C) affects the standard pattern developers use to wrap ipcRenderer.invoke calls, meaning a wide class of real-world apps is susceptible if they load any untrusted content. No vendor-side workarounds exist; patched releases are available across all active Electron version lines. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Electron's contextBridge API provides context isolation: it creates a structured clone boundary between the privileged preload script context (which has access to Node.js and ipcRenderer) and the untrusted renderer/web content context. When a preload script exposes a Promise-returning function via contextBridge.exposeInMainWorld, Electron must marshal the Promise across this boundary. The vulnerability stems from a Function.prototype.bind hijack - malicious web content can override or intercept bind in a way that corrupts Electron's internal marshalling logic, allowing the web content's JS execution context to obtain a reference into the preload world's JavaScript context. Once inside the preload world, all capabilities the preload holds are accessible. In renderers with nodeIntegration enabled or without sandbox restrictions, this directly translates to Node.js access. CWE-693 (Protection Mechanism Failure) accurately characterizes the root cause: the contextBridge mechanism itself fails under adversarial JavaScript prototype manipulation. Affected packages are published as npm/electron across versions prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.

RemediationAI

The only remediation is upgrading to a patched Electron release: 39.8.9 for the v39 line, 40.9.2 for the v40 line, 41.2.2 for the v41 line, or 42.0.0-beta.5 for the v42 beta track. Electron's security advisory explicitly states there are no app-side workarounds - this must be fixed at the framework level. As a defense-in-depth measure prior to patching, apps can reduce blast radius by ensuring renderers load exclusively trusted first-party content (removing untrusted URLs from renderer windows), enabling the Electron sandbox on all renderer processes, and disabling nodeIntegration where not strictly required - neither of these prevents the contextBridge bypass itself but they limit what an attacker gains post-exploitation. Restricting the capabilities exposed via contextBridge to the minimum required set also reduces the attack surface if exploitation occurs. Advisory and version details: https://github.com/electron/electron/security/advisories/GHSA-h7rp-cf8h-j98x.