Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.
Fix
Patch, vendor advisory and mitigation references on NVD 6
- https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba Patch
- https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69 Patch
- https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da Patch
- https://github.com/electron/electron/pull/52133 Issue Tracking, Patch
- https://github.com/electron/electron/releases/tag/v41.10.4 Issue Tracking, Patch
- https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.1 · electronjsNVD modified 2026-10-15 14:01
Affected (CPE criteria) 9
cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*cpe:2.3:a:electronjs:electron:42.0.0:alpha1:*:*:*:node.js:*:*cpe:2.3:a:electronjs:electron:42.0.0:alpha2:*:*:*:node.js:*:*cpe:2.3:a:electronjs:electron:42.0.0:alpha3:*:*:*:node.js:*:*cpe:2.3:a:electronjs:electron:42.0.0:alpha4:*:*:*:node.js:*:*cpe:2.3:a:electronjs:electron:42.0.0:alpha5:*:*:*:node.js:*:*cpe:2.3:a:electronjs:electron:42.0.0:alpha6:*:*:*:node.js:*:*cpe:2.3:a:electronjs:electron:42.0.0:beta1:*:*:*:node.js:*:*cpe:2.3:a:electronjs:electron:42.0.0:beta2:*:*:*:node.js:*:*
References 8
- https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba Patch
- https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69 Patch
- https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da Patch
- https://github.com/electron/electron/pull/52133 Issue Tracking, Patch
- https://github.com/electron/electron/releases/tag/v41.10.4 Issue Tracking, Patch
- https://github.com/electron/electron/releases/tag/v42.5.2 Release Notes
- https://github.com/electron/electron/releases/tag/v43.0.0 Release Notes
- https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4 Vendor Advisory