Varisys

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 41.10.4 Electron versions prior to 42.5.2 Electron versions prior to 43.0.0 **Description** Popups opened from a sandboxed iframe via the OpenURLFromTab navigation path, such as links using `target=" blank"` or middle-clicks, fail to inherit the HTML sandbox restrictions. An untrusted iframe configured with `allow-scripts` and `allow-popups` can open a popup with the full origin of the embedding application. This allows the popup to access the origin's cookies, storage, and same-origin scripting capabilities. This issue only affects applications that embed untrusted content in sandboxed iframes. **Recommendations** Update to version 41.10.4. Update to version 42.5.2. Update to version 43.0.0. Use `setWindowOpenHandler` on the parent `WebContents` to deny or constrain popups opened from sandboxed frames. Avoid applying `allow-popups` to sandboxed iframes that render untrusted content.

**Name of the Vulnerable Software and Affected Versions** Electron versions 42.3.3 through 42.9.9 Electron versions 43.0.0 through 43.4.9 Electron versions 44.0.0-beta.0 through 44.0.0-beta.5 **Description** The sandboxed preload code cache fails to verify that a cached entry matches the preload it was served for. This allows a compromised renderer to write attacker-controlled cache data, which Electron may then reuse during a subsequent load. This process enables the execution of renderer code within the more privileged preload context. This issue specifically affects applications that load untrusted content. **Recommendations** Update to version 42.10.0. Update to version 43.5.0. Update to version 44.0.0-beta.6.