CVE-2026-102676: Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
(updated )
A <webview> could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed.
Apps are only affected if they enable the <webview> tag and the embedder is unsandboxed. Apps that do not use <webview>, or that keep the embedder sandboxed, are not affected.
References
- github.com/advisories/GHSA-9qh4-3jw8-366w
- github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2
- github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671
- github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886
- github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae
- github.com/electron/electron/releases/tag/v41.10.6
- github.com/electron/electron/releases/tag/v42.9.2
- github.com/electron/electron/releases/tag/v43.4.1
- github.com/electron/electron/releases/tag/v44.0.0-beta.5
- github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w
- nvd.nist.gov/vuln/detail/CVE-2026-102676
Code Behaviors & Features
Detect and mitigate CVE-2026-102676 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →