CVE-2026-102674: Electron sandbox escape via popup windows in top-level document

CVE-2026-102674 · Severity: high · CVSS 8.2 · Published 2026-09-29

Electron is a framework for building desktop applications using web technologies. A vulnerability allows sandboxed content to open popup windows that inherit the application's full privileges rather than the sandbox restrictions, potentially giving an attacker the ability to access resources and data the application normally protects. This only affects applications that render untrusted content in a sandboxed document and allow popups from it.

Technologies: Electron, electron (npm), OpenJS Foundation Electron. Vendors: Electron, npm, OpenJS Foundation.

Quick answers

Is CVE-2026-102674 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102674 being exploited in the wild.
How severe is CVE-2026-102674?
High severity, with a CVSS score of 8.2, published 29 September 2026.
Which products and versions are affected?
Electron < 41.10.6, >= 42.0.0-alpha.1 and < 42.9.2, >= 43.0.0-alpha.1 and < 43.4.1, >= 44.0.0-alpha.1 and < 44.0.0-beta.5; electron (npm) SEMVER:introduced=0,fixed=41.10.6; OpenJS Foundation Electron before 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5.
Is there a fix for CVE-2026-102674?
Yes. electron (npm): upgrade to 41.10.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102674 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-102674?
Check whether you run Electron, electron (npm) or OpenJS Foundation Electron at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electron (npm): upgrade to 41.10.6 or later
    npm install electron@41.10.6

Technical details

Sandboxed top-level documents in Electron do not properly propagate HTML sandbox restrictions to windows opened via popups, allowing sandboxed content to escape restrictions by opening new windows. This is a privilege escalation vulnerability affecting the window isolation mechanism. An attacker must be able to execute code within a sandboxed top-level document and trigger a popup; applications using setWindowOpenHandler to deny popups are unaffected.

Affected products

  • Electron Electron < 41.10.6, >= 42.0.0-alpha.1 and < 42.9.2, >= 43.0.0-alpha.1 and < 43.4.1, >= 44.0.0-alpha.1 and < 44.0.0-beta.5

Identifiers

  • CVE-2026-102674
  • GHSA-gr2m-v5gq-v685

Timeline

  • 2026-09-29: disclosed
  • 2026-09-29: patched: versions 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.