All vulnerabilities
CVE-2026-114121GHSA-997q-gvvc-jwmx

Electron: openExternal permission requests can be attributed to the wrong origin

electron electronnpmRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in42.11.3Also 43.7.0, 44.3.0 and 1 moreGitHub
Published21 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 42.11.3electron, npmGitHubnpm install electron@42.11.3
  • 43.7.0electron, npmGitHubnpm install electron@43.7.0
  • 44.3.0electron, npmGitHubnpm install electron@44.3.0
  • 45.0.0-alpha.5electron, npmGitHubnpm install electron@45.0.0-alpha.5

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.

Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies openExternal for untrusted content are not affected.

Workarounds

Deny the openExternal permission for untrusted content, or deny the windows it opens with setWindowOpenHandler.

Fixed Versions

  • 45.0.0-alpha.5
  • 44.3.0
  • 43.7.0
  • 42.11.3

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Text from GitHub Advisory Database

Affected versions 12

  • electron, npm< 42.11.3GitHub
  • electron, npm>= 43.0.0-alpha.1, < 43.7.0GitHub
  • electron, npm>= 44.0.0-alpha.1, < 44.3.0GitHub
  • electron, npm>= 45.0.0-alpha.1, < 45.0.0-alpha.5GitHub
  • electronaffected: < 42.11.3CVE List
  • electronaffected: >= 43.0.0-alpha.1, < 43.7.0CVE List
  • electronaffected: >= 44.0.0-alpha.1, < 44.3.0CVE List
  • electronaffected: >= 45.0.0-alpha.1, < 45.0.0-alpha.5CVE List
  • electron, npmfrom first release, fixed in 42.11.3OSV
  • electron, npmfrom 43.0.0-alpha.1, fixed in 43.7.0OSV
  • electron, npmfrom 44.0.0-alpha.1, fixed in 44.3.0OSV
  • electron, npmfrom 45.0.0-alpha.1, fixed in 45.0.0-alpha.5OSV

References 17