Disclosure summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
Source-reported weakness categories
CWE-266, CWE-693
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-102674
Open original source · Updated Sep 30, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
GitHub Reviewed Security Advisories · GHSA-gr2m-v5gq-v685
Open original source · Updated Sep 29, 2026
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Source severity: HIGH / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | electron | < 41.10.6 | 41.10.6 |
| npm | electron | >= 42.0.0-alpha.1, < 42.9.2 | 42.9.2 |
| npm | electron | >= 43.0.0-alpha.1, < 43.4.1 | 43.4.1 |
| npm | electron | >= 44.0.0-alpha.1, < 44.0.0-beta.5 | 44.0.0-beta.5 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
PUBLISHED 2026-09-29T13:17:07-04:00
MODIFIED 2026-09-30T15:38:27-04:00
INGESTED 2026-10-06T11:43:05-04:00