VulnSocial

CVE-2026-70606Disclosure

LOWCVSS 5.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-668

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-08: 1Patch / Workaround · 2026-08-08: 1Technical Details · 2026-08-08: 108-08
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • rushit@rushit_21
    Disclosure

    Session cache isolation bypass in Electron: ProtocolResponse.url without an explicit session fell through to defaultSession’s cache, crossing isolated partitions (CVE-2026-70606). Fixed via coordinated disclosure. https://github.com/advisories/GHSA-r4w5-6pfg-jxp5 #Electron #BugBounty #CVE

    Post summary

    The advisory reveals a session cache isolation bypass in Electron (CVE-2026-70606) and notes it has been fixed via coordinated disclosure, with technical details and a link to the GitHub advisory.

    0000068
    9 followersView on X

Explore more

Back to dashboard