CVE-2026-70610: CVE-2026-70610: Context Isolation Bypass via Prototype Pollution in Electron contextBridge - CVE Security Report

CVE-2026-70610.md

CVE-2026-70610: CVE-2026-70610: Context Isolation Bypass via Prototype Pollution in Electron contextBridge

CVSS Score: 5.4 Published: 2026-08-05 Full Report: https://cvereports.com/reports/CVE-2026-70610

Summary

A security vulnerability in Electron's contextBridge allows untrusted renderer contexts to bypass context isolation. By passing an object with a crafted proto property, an attacker can pollute the prototype chain of objects copied into the privileged preload context. This occurs because Electron's C++ property copying layer used standard V8 property assignment, which executes prototype setters. This bypasses Electron's context isolation security boundary, potentially enabling remote code execution (RCE) or privileges escalation. The vulnerability has been addressed in Electron versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4.

TL;DR

Electron contextBridge allowed prototype pollution across the context isolation boundary by using standard V8 property setters instead of direct data property definition during object cloning.

Exploit Status: POC

Technical Details

• CWE ID: CWE-1321
• Attack Vector: Network
• Attack Complexity: High
• CVSS Score: 5.4 (Medium)
• Exploit Status: PoC Available
• CISA KEV Status: Not Listed
• Impact: Security Boundary Bypass (Context Isolation Bypass)

Affected Systems

• Electron Framework-based Desktop Applications
• Electron: < 39.8.9 (Fixed in: 39.8.9)
• Electron: >= 40.0.0-alpha.1, < 40.9.2 (Fixed in: 40.9.2)
• Electron: >= 41.0.0-alpha.1, < 41.2.2 (Fixed in: 41.2.2)
• Electron: >= 42.0.0-alpha.1, < 42.0.0-beta.4 (Fixed in: 42.0.0-beta.4)

Mitigation

• Upgrade Electron to a patched version (39.8.9, 40.9.2, 41.2.2, or 42.0.0-beta.4)
• Refactor contextBridge APIs to accept primitive data types rather than complex nested objects
• Implement defensive programming in preload scripts by checking hasOwnProperty before accessing properties
• Validate object prototypes inside the preload script using Object.getPrototypeOf

Remediation Steps:

1. Identify all Electron-based projects utilizing contextBridge to expose APIs to the renderer context.
2. Update dependencies in package.json to reference a secure version: v39.8.9+, v40.9.2+, v41.2.2+, or v42.0.0-beta.4+.
3. Verify preload scripts to ensure they do not perform unsafe property lookups on objects received from the main world.
4. Test the application using automated scripts to verify that prototype pollution payloads do not alter object inheritance behavior.

References

• GitHub Security Advisory GHSA-ff2p-hmqr-hxm4
• Pull Request #51083: Use CreateDataProperty for contextBridge object copy

---

Generated by CVEReports - Automated Vulnerability Intelligence