Packages / electron / Security

ModerateVulnerabilityGHSA-r4w5-6pfg-jxp5CVE-2026-70606Published 5 Aug 2026

Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Affected releases · electron

  • 42.x42.0.0 – 42.5.0Fixed in 42.5.1
  • 41.x41.0.0 – 41.9.0Fixed in 41.9.1
  • 40.x40.0.0 – 40.10.5Fixed in 40.10.6

On 42.x, the newest line:

npm install electron@42.5.1
45.x

  1. Not affected

    45.0.0

    1 release, latest

42.x

  1. Affected

    42.0.0 – 42.5.0

    11 releases

  2. Fixed

    42.5.1 – 42.11.18

    34 releases

41.x

  1. Affected

    41.0.0 – 41.9.0

    22 releases

  2. Fixed

    41.9.1 – 41.10.7

    10 releases

40.x

  1. Affected

    40.0.0 – 40.10.5

    25 releases

  2. Fixed

    40.10.6

    1 release

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions.

Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. Apps that set an explicit session, or that do not isolate content across sessions, are not affected.

Workarounds

Set ProtocolResponse.session explicitly so the request uses the intended session's cache.

Fixed Versions

  • 43.0.0

  • 42.5.1

  • 41.9.1

  • 40.10.6

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org