CVE-2026-102676

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.6 Electron versions prior to 42.9.2 Electron versions prior to 43.4.1 Electron versions prior to 44.0.0-beta.5

Description An Electron <webview> guest can enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder has Node.js integration disabled. This allows untrusted guest content to create a Node-enabled worker with higher privileges than those granted by the embedder. This issue only affects applications that enable the <webview> tag and maintain an unsandboxed embedder.

Recommendations Update to version 41.10.6. Update to version 42.9.2. Update to version 43.4.1. Update to version 44.0.0-beta.5. Remove nodeIntegrationInWorker from the guest preferences in a will-attach-webview handler. Avoid enabling the <webview> tag when loading untrusted content.