{"action":"Upgrade electron to 39.8.9 or later.","affected":[{"fixed":"39.8.9","introduced":"0"},{"fixed":"40.9.2","introduced":"40.0.0-alpha.1"},{"fixed":"41.2.2","introduced":"41.0.0-alpha.1"},{"fixed":"42.0.0-beta.4","introduced":"42.0.0-alpha.1"}],"component":"electron","cve_ids":["CVE-2026-70610"],"ecosystem":"npm","epss":0.00564,"exploited":false,"fixed_versions":["39.8.9","40.9.2","41.2.2","42.0.0-beta.4"],"ghsa_id":"GHSA-ff2p-hmqr-hxm4","id":"tcs_01M5KFN9HEC491KFSQC0PJ5J3R","modified_at":"2026-08-05T17:56:07.830265Z","published_at":"2026-08-05T17:41:20Z","references":["https://osv.dev/vulnerability/GHSA-ff2p-hmqr-hxm4","https://github.com/electron/electron/security/advisories/GHSA-ff2p-hmqr-hxm4","https://github.com/electron/electron/pull/51083","https://github.com/electron/electron/pull/51084","https://github.com/electron/electron/pull/51085","https://github.com/electron/electron/pull/51086","https://github.com/electron/electron/commit/17d5d26499cd279fab48f5f26527f8edc02a7713","https://github.com/electron/electron/commit/23a6efb714dec80e2cf45d3054d18d701162e4dd","https://github.com/electron/electron/commit/4ac50292d552fb510eb778392620c85308770a55","https://github.com/electron/electron/commit/5b699544cbbed51bedb7c60d75c8c42be5825737","https://github.com/electron/electron","https://github.com/electron/electron/releases/tag/v39.8.9","https://github.com/electron/electron/releases/tag/v40.9.2","https://github.com/electron/electron/releases/tag/v41.2.2","https://github.com/electron/electron/releases/tag/v42.0.0-beta.4"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-ff2p-hmqr-hxm4","url":"https://osv.dev/vulnerability/GHSA-ff2p-hmqr-hxm4"}],"summary":"Electron: contextBridge object copy honors prototype setters"}