GitHub Advisoryadvisory · npm

GHSA-x8rc-wpg4-grpf Electron: Cross-origin iframe can position native autofill popup

LOW Published 2026-08-05 Modified 2026-08-05 Official page ↗
Aliases
CVE-2026-70600
Ecosystem
npm
Packages
electron
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-1021
Reviewed
2026-08-05

Affected packages

• npm electron: < 39.8.8 → fixed in 39.8.8 • npm electron: >= 40.0.0-alpha.1, < 40.9.1 → fixed in 40.9.1 • npm electron: >= 41.0.0-alpha.1, < 41.2.1 → fixed in 41.2.1 • npm electron: >= 42.0.0-alpha.1, < 42.0.0-beta.3 → fixed in 42.0.0-beta.3

Description

Impact The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI. Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected. Workarounds Do not embed untrusted content in iframes inside windows that display trusted UI. Fixed Versions • `42.0.0-beta.3` • `41.2.1` • `40.9.0` • `39.8.8` For more information If you have any questions or comments about this advisory, email Electron at [email protected]

Related

Alias · CVE (1)

  • CVE-2026-70600 Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. vulnerability

Weakness · CWE (1)

  • CWE-1021 Improper Restriction of Rendered UI Layers or Frames weakness

References