Is CVE-2026-102673 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102673 being exploited in the wild.

How severe is CVE-2026-102673?

High severity, with a CVSS score of 8.2, published 29 September 2026.

Which products and versions are affected?

Electron before 41.10.4, 42.0.0-alpha.1 to before 42.5.2, 43.0.0-alpha.1 to before 43.0.0, before 41.10.4, 42.x before 42.5.2, 43.x before 43.0.0; electron (npm) SEMVER:introduced=0,fixed=41.10.4.

Is there a fix for CVE-2026-102673?

Yes. electron (npm): upgrade to 41.10.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102673 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102673?

Check whether you run Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102673: Electron sandbox inheritance bypass for popups from iframes

CVE-2026-102673 · Severity: high · CVSS 8.2 · Published 2026-09-29

Electron, a framework for building cross-platform desktop applications, fails to inherit HTML sandbox restrictions when popups are opened from sandboxed iframes through user interaction like clicking links. An attacker who can embed malicious content in an app's sandboxed iframe can bypass the sandbox and gain access to the parent application's cookies, local storage, and ability to execute scripts with the parent origin—potentially leading to account takeover or data theft.

Technologies: Electron, electron (npm). Vendors: Electron, npm.

Quick answers

Is CVE-2026-102673 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102673 being exploited in the wild.
How severe is CVE-2026-102673?: High severity, with a CVSS score of 8.2, published 29 September 2026.
Which products and versions are affected?: Electron before 41.10.4, 42.0.0-alpha.1 to before 42.5.2, 43.0.0-alpha.1 to before 43.0.0, before 41.10.4, 42.x before 42.5.2, 43.x before 43.0.0; electron (npm) SEMVER:introduced=0,fixed=41.10.4.
Is there a fix for CVE-2026-102673?: Yes. electron (npm): upgrade to 41.10.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102673 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102673?: Check whether you run Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 41.10.4 or later
```
npm install electron@41.10.4
```

Technical details

The vulnerability exists in Electron's popup handling (OpenURLFromTab) where sandboxed iframes fail to propagate their HTML sandbox restrictions to newly opened windows. An attacker-controlled iframe sandboxed with `allow-scripts allow-popups` can open a popup via a link click that inherits the parent WebContents origin, bypassing origin separation. The attack requires embedding untrusted content in a sandboxed iframe and relies on user interaction (link click or middle-click), allowing credential or session theft. Patches are available in versions 41.10.4, 42.5.2, and 43.0.0.

Affected products

Electron Electron before 41.10.4, 42.0.0-alpha.1 to before 42.5.2, 43.0.0-alpha.1 to before 43.0.0

Identifiers

CVE-2026-102673
GHSA-hq2x-r82h-9wj4

Timeline

2026-09-29: disclosed: Advisory published
2026-09-29: patched: Fixes released in versions 41.10.4, 42.5.2, and 43.0.0

References

https://api.github.com/users/varisys

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.