Medium severity · published Sep 29, 2026
CVE-2026-102674
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
electron · electron
< 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102674
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102674
x_refsource_CONFIRM
https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685
x_refsource_MISC
https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2
x_refsource_MISC
https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d
x_refsource_MISC
https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886
x_refsource_MISC
https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a
x_refsource_MISC
https://github.com/electron/electron/releases/tag/v41.10.6
More from electron
9.8
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
9.8
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
9.3
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
8.8
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
8.8
CVE-2026-34765
Electron named window.open targets not scoped to the opener's browsing context