CVE-2026-114121

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.3 Electron versions prior to 43.7.0 Electron versions prior to 44.3.0 Electron versions prior to 45.0.0-alpha.5

Description Requests to open external protocol URLs can be attributed to a document other than the one that initiated the request. This causes the requestingUrl passed to the session.setPermissionRequestHandler() function to identify trusted content for a launch requested by untrusted content. Consequently, an application that grants openExternal permissions based on the requesting origin and allows untrusted content to open or navigate windows may allow that untrusted content to launch an OS-registered external application.

Recommendations Update to version 42.11.3 Update to version 43.7.0 Update to version 44.3.0 Update to version 45.0.0-alpha.5