Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
GHSA-gr2m-v5gq-v685 · CVE-2026-102674
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes.
Apps are only affected if they render untrusted content in a sandboxed top-level document that allows popups. Apps that deny popups from untrusted content with setWindowOpenHandler are not affected.
Workarounds
Return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content.
Fixed Versions
44.0.0-beta.543.4.142.9.241.10.6
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
References
- WEB https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685
- WEB https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2
- WEB https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d
- WEB https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886
- WEB https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a
- PACKAGE https://github.com/electron/electron
- WEB https://github.com/electron/electron/releases/tag/v41.10.6
- WEB https://github.com/electron/electron/releases/tag/v42.9.2
- WEB https://github.com/electron/electron/releases/tag/v43.4.1
- WEB https://github.com/electron/electron/releases/tag/v44.0.0-beta.5
Ready to move
Start Securing
Free, no credit card | First findings in minutes