CVE-2026-102673
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.
How to fix
- electronjs electron39.8.8, 40.9.0 or later
- electron41.10.4, 42.5.2, 43.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| electronjs electron | v < 39.8.8, 40.0.0 ≤ v < 40.9.0, 41.0.0 ≤ v ≤ 41.2.1, 42.0.0 | 39.8.8, 40.9.0 |
| electronnpm | v < 41.10.4, 42.0.0-alpha.1 ≤ v < 42.5.2, 43.0.0-alpha.1 ≤ v < 43.0.0 | 41.10.4, 42.5.2, 43.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.