Medium severity · published Oct 21, 2026
CVE-2026-114121
Electron: openExternal permission requests can be attributed to the wrong origin
New
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
electron · electron
< 42.11.3; >= 43.0.0-alpha.1, < 43.7.0; >= 44.0.0-alpha.1, < 44.3.0; >= 45.0.0-alpha.1, < 45.0.0-alpha.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114121
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114121
github.com
https://github.com/electron/electron/commit/25057643bf6d9a20bad69e45707551ccf546f5ce
github.com
https://github.com/electron/electron/commit/8aa5414f73792ed3b2e3f9ab6391b1832e6dc2c3
github.com
https://github.com/electron/electron/commit/92a783952891805f2f82f344c40a6917b98a7d98
github.com
https://github.com/electron/electron/commit/e0a20d5277b567aea8603f8e9852a4341407a586
github.com
https://github.com/electron/electron/commit/e3a400911084537bce7380ffea8af939572ce8dd
github.com
https://github.com/electron/electron/pull/53682
More from electron
9.8
CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
9.8
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
9.3
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
8.8
CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
8.8
CVE-2026-34765
Electron named window.open targets not scoped to the opener's browsing context