{"id":"EUVD-2026-89078","revision":"1d13db3e9aed451f9ea80f169d8ef35b","records":[{"revision":"1d13db3e9aed451f9ea80f169d8ef35b","observedAt":"2026-11-03T02:57:36.839+00:00","statement":{"source":"euvd","id":"EUVD-2026-89078","aliases":["CVE-2026-102673","GHSA-hq2x-r82h-9wj4"],"title":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including…","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","score":8.2,"severity":null}],"references":["https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4","https://github.com/electron/electron/pull/52133","https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba","https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69","https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da","https://github.com/electron/electron/releases/tag/v41.10.4","https://github.com/electron/electron/releases/tag/v42.5.2","https://github.com/electron/electron/releases/tag/v43.0.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-89078","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 29, 2026, 4:38:41 PM","dateUpdated":"Sep 30, 2026, 8:11:08 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-89078","identifiers":["EUVD-2026-89078","CVE-2026-102673","GHSA-hq2x-r82h-9wj4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}