CVE-2026-102674: Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Windows opened from a sandboxed top-level document did not inherit that document’s HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app’s full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes.
Apps are only affected if they render untrusted content in a sandboxed top-level document that allows popups. Apps that deny popups from untrusted content with setWindowOpenHandler are not affected.
References
- github.com/advisories/GHSA-gr2m-v5gq-v685
- github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2
- github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d
- github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886
- github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a
- github.com/electron/electron/releases/tag/v41.10.6
- github.com/electron/electron/releases/tag/v42.9.2
- github.com/electron/electron/releases/tag/v43.4.1
- github.com/electron/electron/releases/tag/v44.0.0-beta.5
- github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685
- nvd.nist.gov/vuln/detail/CVE-2026-102674
Code Behaviors & Features
Detect and mitigate CVE-2026-102674 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →