All vulnerabilities
CVE-2026-102674GHSA-gr2m-v5gq-v685

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

electron electronnpmRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in41.10.6Also 42.9.2, 43.4.1 and 1 moreGitHub
Published29 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

  • 41.10.6electron, npmGitHubnpm install electron@41.10.6
  • 42.9.2electron, npmGitHubnpm install electron@42.9.2
  • 43.4.1electron, npmGitHubnpm install electron@43.4.1
  • 44.0.0-beta.5electron, npmGitHubnpm install electron@44.0.0-beta.5

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes.

Apps are only affected if they render untrusted content in a sandboxed top-level document that allows popups. Apps that deny popups from untrusted content with setWindowOpenHandler are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content.

Fixed Versions

  • 44.0.0-beta.5
  • 43.4.1
  • 42.9.2
  • 41.10.6

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Text from GitHub Advisory Database

Affected versions 12

  • electron, npm< 41.10.6GitHub
  • electron, npm>= 42.0.0-alpha.1, < 42.9.2GitHub
  • electron, npm>= 43.0.0-alpha.1, < 43.4.1GitHub
  • electron, npm>= 44.0.0-alpha.1, < 44.0.0-beta.5GitHub
  • electronaffected: < 41.10.6CVE List
  • electronaffected: >= 42.0.0-alpha.1, < 42.9.2CVE List
  • electronaffected: >= 43.0.0-alpha.1, < 43.4.1CVE List
  • electronaffected: >= 44.0.0-alpha.1, < 44.0.0-beta.5CVE List
  • electron, npmfrom first release, fixed in 41.10.6OSV
  • electron, npmfrom 42.0.0-alpha.1, fixed in 42.9.2OSV
  • electron, npmfrom 43.0.0-alpha.1, fixed in 43.4.1OSV
  • electron, npmfrom 44.0.0-alpha.1, fixed in 44.0.0-beta.5OSV

References 10