CVE-2026-102673: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
Popups opened from a sandboxed iframe through a link (for example target="_blank" or a middle-click) did not inherit the iframe’s HTML sandbox restrictions. Content that was meant to run sandboxed could open a popup with the embedding app’s full origin, gaining access to that origin’s cookies, storage, and same-origin scripting.
Apps are only affected if they embed untrusted content in iframes sandboxed with allow-scripts allow-popups. Apps that do not embed untrusted content in sandboxed iframes are not affected.
References
- github.com/advisories/GHSA-hq2x-r82h-9wj4
- github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba
- github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69
- github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da
- github.com/electron/electron/pull/52133
- github.com/electron/electron/releases/tag/v41.10.4
- github.com/electron/electron/releases/tag/v42.5.2
- github.com/electron/electron/releases/tag/v43.0.0
- github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4
- nvd.nist.gov/vuln/detail/CVE-2026-102673
Code Behaviors & Features
Detect and mitigate CVE-2026-102673 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →