GHSA-r4w5-6pfg-jxp5 CVE-2026-70606
Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
- Severity
- 5.9 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.26%
- Chance of exploitation in the next 30 days. Higher than 17.10% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-668 Exposure of Resource to Wrong Sphere
- Fix
43.0.0- Upgrade electron to this version or later
Description
Impact
When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions.
Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. Apps that set an explicit session, or that do not isolate content across sessions, are not affected.
Workarounds
Set ProtocolResponse.session explicitly so the request uses the intended session's cache.
Fixed Versions
43.0.042.5.141.9.140.10.6
For more information
If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| electron | >= 43.0.0-alpha.1, < 43.0.0 |
43.0.0 |
| electron | >= 42.0.0-alpha.1, < 42.5.1 |
42.5.1 |
| electron | >= 41.0.0-alpha.1, < 41.9.1 |
41.9.1 |
| electron | >= 40.0.0-alpha.1, < 40.10.6 |
40.10.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
electron npm → 43.0.0
- npm
npm install electron@43.0.0- yarn
yarn add electron@43.0.0- pnpm
pnpm add electron@43.0.0
Severity breakdown
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Weakness
CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qqvq-6xgj-jw8g Electron affected by libvpx's heap buffer overflow in vp8 encoding | High Known exploited | Also affects electron |
| GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable | High Known exploited | Also affects electron |
| GHSA-995f-9x5r-2rcj Heap buffer overflow in GPU | Critical Known exploited | Also affects electron |
| GHSA-jr5w-w6x2-84p9 Electron: Mitigation for compromised eMudhra intermediate certificates | High | Also affects electron |
| GHSA-h3v5-h239-pg29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry | Low | Also affects electron |
| GHSA-3qxv-5xgr-q7w9 Electron: Frame subscription trusts GPU-supplied frame geometry | Low | Also affects electron |
| GHSA-997q-gvvc-jwmx Electron: openExternal permission requests can be attributed to the wrong origin | Medium | Also affects electron |
| GHSA-fw47-9c62-h3vw Electron: HID and USB permission checks can be attributed to the wrong origin | Medium | Also affects electron |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor