CVE-2026-70608

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.10 Electron versions prior to 41.10.3 Electron versions prior to 42.0.1

Description A sandboxed iframe lacking the allow-popups keyword can open a new window or trigger the setWindowOpenHandler() function without user interaction. This occurs because new-window navigations using the OpenURL path fail to apply the iframe sandbox popup restriction. This issue affects applications that embed untrusted content in sandboxed iframes and rely solely on the absence of allow-popups to prevent window creation.

Recommendations Update to version 39.8.10. Update to version 41.10.3. Update to version 42.0.1. As a workaround, return { action: 'deny' } from the setWindowOpenHandler() function for any untrusted content instead of relying exclusively on the iframe sandbox.