Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-70608 · Microsoft / collected KEV context

EUVD-2026-53564

GHSA-9f4c-93c8-jc8g

cve-program · CVE-2026-70608

• https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g
• https://github.com/electron/electron/pull/51437
• https://github.com/electron/electron/pull/51438
• https://github.com/electron/electron/pull/51439
• https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57
• https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3
• https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f
• https://github.com/electron/electron/releases/tag/v39.8.10
• https://github.com/electron/electron/releases/tag/v41.10.3
• https://github.com/electron/electron/releases/tag/v42.0.1

euvd · EUVD-2026-53564

• https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g
• https://github.com/electron/electron/pull/51437
• https://github.com/electron/electron/pull/51438
• https://github.com/electron/electron/pull/51439
• https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57
• https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3
• https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f
• https://github.com/electron/electron/releases/tag/v39.8.10
• https://github.com/electron/electron/releases/tag/v41.10.3
• https://github.com/electron/electron/releases/tag/v42.0.1

nvd · CVE-2026-70608

• https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57
• https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3
• https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f
• https://github.com/electron/electron/pull/51437
• https://github.com/electron/electron/pull/51438
• https://github.com/electron/electron/pull/51439
• https://github.com/electron/electron/releases/tag/v39.8.10
• https://github.com/electron/electron/releases/tag/v41.10.3
• https://github.com/electron/electron/releases/tag/v42.0.1
• https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g

osv · GHSA-9f4c-93c8-jc8g

• https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g
• https://github.com/electron/electron/pull/51437
• https://github.com/electron/electron/pull/51438
• https://github.com/electron/electron/pull/51439
• https://github.com/electron/electron/commit/3ff23c52ab364a0afc6ab5bd7851291d3159de57
• https://github.com/electron/electron/commit/57cbe329c4ae8aab5ac5ebdcb588adc9a11de0d3
• https://github.com/electron/electron/commit/68cf8b7d9122260f6b534a69a82c701a56cf159f
• https://github.com/electron/electron
• https://github.com/electron/electron/releases/tag/v39.8.10
• https://github.com/electron/electron/releases/tag/v41.10.3
• https://github.com/electron/electron/releases/tag/v42.0.1

No related operational record is retained in the current change model.