cyfenced.com →

[ CVE-2026-102673 · Published 29 Sep 2026 ]

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

CVSS 6.1 EPSS <1%Fix available

[ Description ]Official description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.

[ Fixes ]Fixes and patches

  • electron 41.10.4Fixed version · GitHub Advisories · npm package electron: upgrade to 41.10.4 or later (affected < 41.10.4)
  • electron 42.5.2Fixed version · GitHub Advisories · npm package electron: upgrade to 42.5.2 or later (affected >= 42.0.0-alpha.1, < 42.5.2)
  • electron 43.0.0Fixed version · GitHub Advisories · npm package electron: upgrade to 43.0.0 or later (affected >= 43.0.0-alpha.1, < 43.0.0)
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Packages ]Affected open-source packages

[ References ]References