CVE-2026-102674: Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Windows opened from a sandboxed top-level document did not inherit that document’s HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app’s full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes.
Apps are only affected if they render untrusted content in a sandboxed top-level document that allows popups. Apps that deny popups from untrusted content with setWindowOpenHandler are not affected.
References
- github.com/advisories/GHSA-gr2m-v5gq-v685
- github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2
- github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d
- github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886
- github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a
- github.com/electron/electron/releases/tag/v41.10.6
- github.com/electron/electron/releases/tag/v42.9.2
- github.com/electron/electron/releases/tag/v43.4.1
- github.com/electron/electron/releases/tag/v44.0.0-beta.5
- github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685
- nvd.nist.gov/vuln/detail/CVE-2026-102674
Code Behaviors & Features
Detect and mitigate CVE-2026-102674 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →