CVE-2026-70599: Electron Permission Check Main Frame

Permission check evaluates permissions against the primary main frame instead of the requesting RenderFrameHost. This allows cross-origin iframes to inherit permissions intended only for the top-level main frame.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0C++
greprules fetch cve-2026-70599-electron-permission-check-main-frame --engine opengrep

Description

Permission check evaluates permissions against the primary main frame instead of the requesting RenderFrameHost. This allows cross-origin iframes to inherit permissions intended only for the top-level main frame.