CVE-2026-102674

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.6 Electron versions prior to 42.9.2 Electron versions prior to 43.4.1 Electron versions prior to 44.0.0-beta.5

Description Windows opened from a sandboxed top-level document do not inherit the active HTML sandbox restrictions of that document. This allows untrusted content permitted to open popups to create a new window with the full origin of the Electron application instead of the restricted origin intended by the sandbox. This issue does not affect applications that deny such popups using the setWindowOpenHandler function.

Recommendations Update to version 41.10.6. Update to version 42.9.2. Update to version 43.4.1. Update to version 44.0.0-beta.5. As a temporary workaround, return { action: 'deny' } from the setWindowOpenHandler function for windows opened by untrusted content.