Electron applications that expose Promise-returning functions via the contextBridge can be compromised when an external web page loads untrusted content. The vulnerability allows the attacker to hijack Function.prototype.bind, bypassing context isolation and gaining access to the isolated preload world. In renderers without a sandbox or with nodeIntegration enabled, the attacker may further elevate privileges to Node.js, potentially executing arbitrary code and accessing sensitive data.

Electron, versions prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, in applications that expose Promise-returning functions through contextBridge to windows which load untrusted web content.

This flaw carries a CVSS score of 7.5, indicating high severity, and is currently not listed in CISA KEV. The Exploit Probability (EPSS) value is not available, but the vulnerability type (CWE‑693) and the nature of the attack vector suggest that the exploitation risk is significant. Passing untrusted content to such applications provides a feasible path for an attacker to hijack context isolation and potentially acquire Node.js capabilities.