CVE-2026-102673 · GHSA-hq2x-r82h-9wj4
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
- Risk score
- 42/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited H…
- Affected
- electron (npm) < 41.10.4; electron (npm) >= 42.0.0-alpha.1, < 42.5.2; electron (npm) >= 43.0.0-alpha.1, < 43.0.0
- Fix
- Upgrade electron to 41.10.4 or 42.5.2 or 43.0.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
electron: Red, act today. Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing…
The flaws
- CVE-2026-102673: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab (CVSS 6.1 · EPSS 0%)
- CVE-2026-102676: Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions (CVSS 9.8 · EPSS 0%)
- CVE-2026-102677: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer (CVSS 8.8 · EPSS 0%)
- CVE-2026-102674: Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions (CVSS 6.1 · EPSS 0%)
The fix
Upgrade electron: 41.10.4 · 42.5.2 · 43.0.0 · 41.10.6 · 42.9.2 · 43.4.1 or later on your release line
Who is exposed: electron (npm) < 41.10.6; electron (npm) >= 42.0.0-alpha.1, < 42.9.2; electron (npm) >= 43.0.0-alpha.1, < 43.4.1; electron (npm) >= 44.0.0-alpha.1, < 44.0.0-beta.5
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-346 (CWE-346). 54 other warnings in 30 days
Why it is Yellow
- CVSS 6.1 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| electron | npm | < 41.10.4 | 41.10.4 |
| electron | npm | >= 42.0.0-alpha.1, < 42.5.2 | 42.5.2 |
| electron | npm | >= 43.0.0-alpha.1, < 43.0.0 | 43.0.0 |
References
- https://github.com/advisories/GHSA-hq2x-r82h-9wj4
- https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4
- https://github.com/electron/electron/pull/52133
- https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba
- https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69
- https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da
- https://github.com/electron/electron/releases/tag/v41.10.4
- https://github.com/electron/electron/releases/tag/v42.5.2
- https://github.com/electron/electron/releases/tag/v43.0.0
- https://github.com/advisories/GHSA-hq2x-r82h-9wj4
Original description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.
Last activity 29 Sep 2026. Patch Forecast updates every hour.