{"id":"EUVD-2026-89078","enisaUuid":"f9f419b1-0e80-38b1-bcdb-ae2b7de6aac9","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron\u0027s OpenURLFromTab navigation path, including links using target\u003d\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application\u0027s full origin, exposing that origin\u0027s cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.","datePublished":"Sep 29, 2026, 4:38:41 PM","dateUpdated":"Sep 30, 2026, 8:11:08 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4\nhttps://github.com/electron/electron/pull/52133\nhttps://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba\nhttps://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69\nhttps://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da\nhttps://github.com/electron/electron/releases/tag/v41.10.4\nhttps://github.com/electron/electron/releases/tag/v42.5.2\nhttps://github.com/electron/electron/releases/tag/v43.0.0\n","aliases":"CVE-2026-102673\nGHSA-hq2x-r82h-9wj4\n","assigner":"GitHub_M","epss":0.13,"enisaIdProduct":[{"id":"6602290c-60de-30c7-8ac8-0d460358db95","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 41.10.4"},{"id":"e3e5087a-bac4-3ec3-8293-deaa1fd879a0","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"43.0.0-alpha.1, \u003c 43.0.0"},{"id":"f8df4c14-5d79-3dc8-9379-5d79005514ed","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.5.2"}],"enisaIdVendor":[{"id":"327d5e3b-7bc7-3890-9e99-b4970c401e9e","vendor":{"name":"electron"}}],"enisaIdVulnerability":[{"id":"9f2d4e55-2166-3ecd-87d5-b330028ea799","vulnerability":{"id":"CVE-2026-102673","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron\u0027s OpenURLFromTab navigation path, including links using target\u003d\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application\u0027s full origin, exposing that origin\u0027s cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.","datePublished":"Sep 29, 2026, 4:38:41 PM","dateUpdated":"Sep 30, 2026, 8:11:08 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4\nhttps://github.com/electron/electron/pull/52133\nhttps://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba\nhttps://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69\nhttps://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da\nhttps://github.com/electron/electron/releases/tag/v41.10.4\nhttps://github.com/electron/electron/releases/tag/v42.5.2\nhttps://github.com/electron/electron/releases/tag/v43.0.0\n","enisa_id":"EUVD-2026-89078\n","assigner":"GitHub_M","epss":0.13,"dataProcessed":"Oct 27, 2026, 7:15:40 AM","vulnerabilityProduct":[{"id":"cdd231b0-60f8-346f-af23-eead18c60d44","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.5.2"},{"id":"d640acd5-3888-3258-b7c3-e15b334bf5eb","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 41.10.4"},{"id":"f9092115-ddff-3efc-a291-94c81158a643","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"43.0.0-alpha.1, \u003c 43.0.0"}],"vulnerabilityVendor":[{"id":"2cfeedb0-bf95-37ca-bb99-f43e8973ff50","vendor":{"name":"electron"}}]}},{"id":"d3eccd54-396a-343c-9c16-b5f4d4945d95","vulnerability":{"id":"GHSA-hq2x-r82h-9wj4","description":"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab","datePublished":"Sep 29, 2026, 6:05:34 PM","dateUpdated":"Sep 29, 2026, 6:05:35 PM","baseScore":0.0,"references":"https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4\nhttps://github.com/electron/electron/pull/52133\nhttps://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba\nhttps://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69\nhttps://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da\nhttps://github.com/electron/electron\nhttps://github.com/electron/electron/releases/tag/v41.10.4\nhttps://github.com/electron/electron/releases/tag/v42.5.2\nhttps://github.com/electron/electron/releases/tag/v43.0.0\n","enisa_id":"EUVD-2026-89078\n","aliases":"CVE-2026-102673\nGHSA-hq2x-r82h-9wj4\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}