CVE-2026-102673 in Electron
Summary
by MITRE • 09/29/2026
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability described pertains to the Electron framework, a widely used runtime for building cross-platform desktop applications with web technologies such as JavaScript, HTML, and CSS. In versions prior to 41.10.4, 42.5.2, and 43.0.0, there was a critical flaw in how popups were handled when initiated from within a sandboxed iframe through Electron's OpenURLFromTab navigation path. This specific code path includes interactions such as clicking links with the target="_blank" attribute or performing middle-click actions on hyperlinks. The core issue lies in the failure to inherit HTML sandbox restrictions for these newly opened windows, which represents a significant deviation from expected security behavior where context isolation should be strictly maintained regardless of how navigation is triggered.
From a technical perspective, this flaw allows an untrusted iframe configured with allow-scripts and allow-popups permissions to bypass intended containment measures. When such an iframe triggers the opening of a popup via the affected navigation path, the resulting window does not inherit the restrictive sandbox attributes applied to its parent context. Consequently, the popup is granted full access to the embedding application's origin. This effectively breaks the principle of least privilege by elevating the privileges of content that was intended to be isolated and restricted. The vulnerability exploits the gap between standard browser behavior for same-origin popups and Electron's specific implementation details regarding sandbox inheritance during programmatic or user-initiated navigation events.
The operational impact of this vulnerability is severe, particularly in applications that embed untrusted third-party content within iframes while maintaining a sandboxed environment to mitigate risks from potentially malicious scripts. An attacker who can control the content loaded into such an iframe could exploit this flaw to open a popup window with full access to the application's origin. This grants the attacker unrestricted read and write access to cookies, local storage, session data, and other sensitive information associated with that origin. Furthermore, it enables same-origin scripting attacks where malicious code can interact directly with the main application's DOM and APIs as if it were part of the primary page context. This could lead to complete compromise of user sessions, theft of authentication tokens, or further exploitation within the trusted environment of the desktop application.
This issue aligns with CWE-200, which covers Information Exposure, specifically regarding sensitive information being accessible due to improper access control mechanisms in web applications and frameworks. It also relates to CWE-1021, Improper Restriction of Rendered UI Layers or Frames, as it involves the failure to properly restrict the rendering context and permissions of nested frames relative to their parent container. In terms of MITRE ATT&CK tactics, this vulnerability facilitates Initial Access through exploitation of client-side logic flaws and enables Credential Access by allowing unauthorized retrieval of session cookies and stored credentials from the compromised origin. It represents a classic case where security controls are bypassed due to inconsistent application of sandbox policies across different navigation contexts within the same process space.
Mitigation for this vulnerability requires upgrading Electron to version 41.10.4, 42.5.2, or 43.0.0 and later, as these releases contain patches that correctly enforce inherited HTML sandbox restrictions on popups opened via the OpenURLFromTab path. For developers unable to upgrade immediately, a temporary workaround involves avoiding the use of target="_blank" or middle-click navigation from within any iframe that is not fully trusted and strictly sandboxed without allow-popups permissions if possible. Alternatively, implementing additional client-side checks in the main process to validate the referrer origin before allowing popup creation can provide some mitigation, though upgrading remains the only definitive solution given the depth of the framework-level flaw. Applications that do not embed untrusted content in sandboxed iframes are generally not affected by this specific vector and may continue operating without immediate risk from this particular exploit path.