{"id":"CVE-2026-70606","aliases":["GHSA-r4w5-6pfg-jxp5"],"url":"https://o3.security/vulnerability/CVE-2026-70606","summary":"Electron: ProtocolResponse.url reuses the default session cache instead of the registering session","details":"### Impact\nWhen a custom protocol handler returned a `ProtocolResponse` with a `url` and no `session`, Electron made the upstream request through `defaultSession` instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions.\n\nApps that use `ProtocolResponse.url`, omit `ProtocolResponse.session`, and rely on separate sessions to isolate content are affected. Apps that set an explicit `session`, or that do not isolate content across sessions, are not affected.\n\n### Workarounds\nSet `ProtocolResponse.session` explicitly so the request uses the intended session's cache.\n\n### Fixed Versions\n* `43.0.0`\n* `42.5.1`\n* `41.9.1`\n* `40.10.6`\n\n### For more information\nIf you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org)","published":"2026-08-05T16:07:46.008Z","modified":"2026-10-28T02:31:13.928200549Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N"},"epss":{"score":0.00157,"percentile":0.05335,"asOf":"2026-08-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"electron","fixedVersion":"43.0.0"},{"ecosystem":"npm","name":"electron","fixedVersion":"42.5.1"},{"ecosystem":"npm","name":"electron","fixedVersion":"41.9.1"},{"ecosystem":"npm","name":"electron","fixedVersion":"40.10.6"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70606.json"},{"type":"ADVISORY","url":"https://github.com/electron/electron/security/advisories/GHSA-r4w5-6pfg-jxp5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70606"},{"type":"PACKAGE","url":"https://github.com/electron/electron"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:13.928200549Z"}}