CVE-2026-102673
EUVD-2026-8907829.09.2026, 17:17
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| electronjs | electron | 𝑥 < 39.8.8 |
| electronjs | electron | 40.0.0 ≤ 𝑥 < 40.9.0 |
| electronjs | electron | 41.0.0 ≤ 𝑥 ≤ 41.2.1 |
| electronjs | electron | 42.0.0:alpha1 |
| electronjs | electron | 42.0.0:alpha2 |
| electronjs | electron | 42.0.0:alpha3 |
| electronjs | electron | 42.0.0:alpha4 |
| electronjs | electron | 42.0.0:alpha5 |
| electronjs | electron | 42.0.0:alpha6 |
| electronjs | electron | 42.0.0:beta1 |
| electronjs | electron | 42.0.0:beta2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References