CVE-2026-70610: Context Isolation Bypass via Prototype Pollution in Electron contextBridge
Vulnerability ID: CVE-2026-70610
CVSS Score: 5.4
Published: 2026-08-05
A security vulnerability in Electron's contextBridge allows untrusted renderer contexts to bypass context isolation. By passing an object with a crafted proto property, an attacker can pollute the prototype chain of objects copied into the privileged preload context. This occurs because Electron's C++ property copying layer used standard V8 property assignment, which executes prototype setters. This bypasses Electron's context isolation security boundary, potentially enabling remote code execution (RCE) or privileges escalation. The vulnerability has been addressed in Electron versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.
TL;DR
Electron contextBridge allowed prototype pollution across the context isolation boundary by using standard V8 property setters instead of direct data property definition during object cloning.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-1321
- Attack Vector: Network
- Attack Complexity: High
- CVSS Score: 5.4 (Medium)
- Exploit Status: PoC Available
- CISA KEV Status: Not Listed
- Impact: Security Boundary Bypass (Context Isolation Bypass)
Affected Systems
- Electron Framework-based Desktop Applications
-
Electron: < 39.8.9 (Fixed in:
39.8.9) -
Electron: >= 40.0.0-alpha.1, < 40.9.2 (Fixed in:
40.9.2) -
Electron: >= 41.0.0-alpha.1, < 41.2.2 (Fixed in:
41.2.2) -
Electron: >= 42.0.0-alpha.1, < 42.0.0-beta.4 (Fixed in:
42.0.0-beta.4)
Code Analysis
Commit: 17d5d26
contextBridge: prevent prototype pollution via proto in object copy
Commit: 23a6efb
contextBridge: resolve proxy.Set vulnerability in v40 branch
Commit: 4ac5029
contextBridge: backport CreateDataProperty fix to v41 branch
Commit: 5b69954
contextBridge: backport CreateDataProperty fix to v42 branch
Exploit Details
- GitHub Security Advisory: Exploit details outlining object property transfer boundary escape tests
Mitigation Strategies
- Upgrade Electron to a patched version (39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.4)
- Refactor contextBridge APIs to accept primitive data types rather than complex nested objects
- Implement defensive programming in preload scripts by checking hasOwnProperty before accessing properties
- Validate object prototypes inside the preload script using Object.getPrototypeOf
Remediation Steps:
- Identify all Electron-based projects utilizing contextBridge to expose APIs to the renderer context.
- Update dependencies in package.json to reference a secure version: v39.8.9+, v40.9.2+, v41.2.2+, or v42.0.0-beta.4+.
- Verify preload scripts to ensure they do not perform unsafe property lookups on objects received from the main world.
- Test the application using automated scripts to verify that prototype pollution payloads do not alter object inheritance behavior.
References
- GitHub Security Advisory GHSA-ff2p-hmqr-hxm4
- Pull Request #51083: Use CreateDataProperty for contextBridge object copy
Read the full report for CVE-2026-70610 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)