CVE-2026-113796 in Electron
Summary
by MITRE • 10/22/2026
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application that loads untrusted content and permits it to open new windows could therefore allow that content to make a credentialed request to another site that relies on SameSite cookies for CSRF protection. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
Electron serves as a foundational framework enabling the development of cross-platform desktop applications through standard web technologies such as JavaScript, HTML, and CSS. Within this ecosystem, the handling of navigation events is critical for maintaining security boundaries between different contexts within an application. Prior to specific patch releases including versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, a significant flaw existed in how Electron processed navigations triggered by user interactions with links that opened new windows. The framework incorrectly classified these page openings as application-initiated navigations rather than preserving the original page containing the link as the true initiator of the request. This misclassification fundamentally altered the security context associated with subsequent network requests generated from those newly opened contexts.
The technical consequence of this misclassification is a failure to correctly enforce SameSite cookie attributes and fetch site headers. Specifically, when a new window was opened via a link click, the resulting top-level HTTP request was erroneously treated as same-site relative to the target domain. This error caused browsers or underlying web views to include cookies marked with the SameSite=Strict attribute in requests that should have been considered cross-site. Furthermore, the Sec-Fetch-Site header failed to accurately identify the initiating page, thereby stripping away a key defense mechanism used by modern servers to distinguish between legitimate same-origin requests and potentially malicious cross-origin requests. This behavior effectively bypassed browser-level protections designed to prevent Cross-Site Request Forgery attacks that rely on SameSite cookie policies for enforcement.
The operational impact of this vulnerability is severe for applications that load untrusted content or allow third-party web pages to open new windows within the Electron shell. An attacker who can induce a user to click a link in such an environment could exploit this flaw to perform Cross-Site Request Forgery attacks against other sites where the victim holds active, SameSite=Strict authenticated sessions. Because the request appears same-site due to the framework's error, sensitive actions on those external services could be executed without proper CSRF tokens or origin validation checks that depend on accurate site identification. This undermines the security model for any Electron-based application acting as a container for untrusted web content while maintaining authentication state with backend servers via cookies.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF), specifically in contexts where SameSite cookie attributes are relied upon for protection but fail due to incorrect context classification. It also relates to ATT&CK technique T1078, Valid Accounts, as it allows an attacker to leverage existing valid credentials stored in cookies to perform unauthorized actions on behalf of the user. The flaw highlights the importance of accurate origin and initiator tracking in hybrid desktop-web architectures where security boundaries must be strictly maintained between different web contexts loaded within a single application instance.
To mitigate this risk, organizations utilizing Electron frameworks must ensure that all client applications are updated to at least version 42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.6 and later stable releases. Developers should also review their application architecture for any instances where untrusted content is permitted to open new windows without strict sandboxing or origin validation policies in place. Implementing additional server-side CSRF protections that do not solely rely on SameSite cookie attributes, such as custom request tokens or double-submit cookie patterns, can provide defense-in-depth against similar misclassifications in other frameworks or future edge cases. Regularly updating dependencies and monitoring for security advisories from the Electron project is essential to maintaining a secure posture against these types of context confusion vulnerabilities.