CVE-2026-70610: 
JavaScript vulnerability analysis and mitigation

CVE-2026-70610 is a prototype pollution vulnerability in the Electron framework's contextBridge component, formally titled "contextBridge object copy incorrectly honours setters on prototype." Objects copied across the contextBridge boundary from untrusted renderer content could carry an attacker-influenced prototype, enabling prototype-pollution-style attacks against preload code even when context isolation is enabled. Affected versions include all Electron releases prior to 39.8.9, 40.x before 40.9.2, 41.x before 41.2.2, and 42.0.0-alpha/beta releases before 42.0.0-beta.4. The advisory was published on August 5, 2026, with a CVSS v3.1 base score of 5.4 (Moderate) (GitHub Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution). When Electron's contextBridge copies objects from the untrusted renderer process to the privileged preload context, it previously used a property assignment mechanism that honored prototype setter traps, rather than using CreateDataProperty (which bypasses prototype chain setters). An attacker controlling renderer-side content could craft an object with a malicious prototype setter that executes attacker-controlled code when the preload script reads a property from the copied object. The fix, implemented across four backport pull requests (#51083–#51086), switches the copy mechanism to CreateDataProperty to ensure properties are written directly onto the target object without invoking prototype setters (GitHub Advisory, PR #51083, PR #51084).

Successful exploitation allows an attacker controlling untrusted renderer content to pollute the prototype chain accessible to the preload script, potentially overriding built-in properties or injecting malicious behavior into privileged preload code. This can result in limited confidentiality and integrity impacts — specifically, unauthorized reading or modification of data accessible to the preload context — though availability is not directly affected. The scope is changed (S:C) because the vulnerability crosses the security boundary between the untrusted renderer and the privileged preload context, which is the core security guarantee of Electron's context isolation model (GitHub Advisory).

1. Identify a vulnerable target: Locate an Electron application running a version prior to 39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.4 whose preload script accepts object arguments from renderer content and reads properties from them without Object.hasOwn() or similar own-property checks.
2. Control renderer content: Gain the ability to execute JavaScript in the renderer process — for example, by exploiting an XSS vulnerability in a loaded web page, or by being the operator of content loaded in the Electron app's web view.
3. Craft a malicious object: In the renderer, create an object with a poisoned prototype that defines a getter or setter for a property the preload script is known to read (e.g., Object.defineProperty(Object.prototype, 'targetProp', { get() { /* malicious code */ } })).
4. Pass the object across contextBridge: Invoke a contextBridge-exposed API that accepts the crafted object as an argument, causing Electron to copy it into the preload context while honoring the prototype setter.
5. Trigger preload code execution: When the preload script reads the targeted property from the copied object, the attacker-controlled getter/setter fires in the preload context, enabling code execution or data exfiltration within the preload's privilege level (GitHub Advisory).

Electron has released patched versions: 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4. Application developers should upgrade their bundled Electron dependency to one of these versions as the primary remediation. As a short-term workaround, preload code should validate all objects received from untrusted renderer content using Object.hasOwn() checks, or copy incoming objects onto a null-prototype object (e.g., Object.assign(Object.create(null), untrustedObj)) before accessing any properties. Questions can be directed to the Electron security team at security@electronjs.org (GitHub Advisory).