# CVE-2026-113796: Electron SameSite cookie bypass in cross-site navigation

Source: https://junglewise.ai/threats/cve-2026-113796-electron-is-a-framework-for-writing-cross-platform-desktop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-113796 · Severity: medium · CVSS 4.2 · Published 2026-10-21

Electron is a framework for building desktop applications using web technologies. When an Electron app loads untrusted content and permits it to open new windows via links, that content could bypass CSRF protections by making credentialed requests to other sites. An attacker could exploit this to perform unauthorized actions on behalf of the user, such as changing account settings or making unauthorized transactions on affected sites.

Technologies: [Electron](https://junglewise.ai/threats/technologies/electron-electron), [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [Electron](https://junglewise.ai/threats/vendors/electron), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-113796 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113796 being exploited in the wild.

**How severe is CVE-2026-113796?** Medium severity, with a CVSS score of 4.2, published 21 October 2026.

**Which products and versions are affected?** Electron prior to 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6; electron (npm) >= 45.0.0-alpha.1, < 45.0.0-alpha.6, SEMVER:introduced=45.0.0-alpha.1,fixed=45.0.0-alpha.6.

**Is there a fix for CVE-2026-113796?** Yes. electron (npm): upgrade to 45.0.0-alpha.6 or later. Until then: Disable popup windows in untrusted content by ensuring webview elements without the `allowpopups` attribute reject new-window navigation requests from links.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21","note":"CVE-2026-113796 published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113796 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-113796?** Check whether you run Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 45.0.0-alpha.6 or later

  ```sh
  npm install electron@45.0.0-alpha.6
  ```


Disable popup windows in untrusted content by ensuring webview elements without the `allowpopups` attribute reject new-window navigation requests from links.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21","note":"CVE-2026-113796 published"}]

## Technical details

Electron incorrectly classified new-window navigations initiated by links (modifier-click, target="_blank", form post) as application-initiated rather than preserving the original page as the initiator. This caused SameSite=Strict cookies to be sent and Sec-Fetch-Site headers to be misreported, breaking CSRF protection mechanisms. The vulnerability requires the Electron app to load untrusted content and permit popup windows; it is fixed by routing these navigations through the window-open policy and preserving initiator context.

## Affected products

- Electron Electron prior to 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6

## Identifiers

- CVE-2026-113796
- GHSA-2p8c-gr87-2676

## References

- [https://github.com/electron/electron/commit/079b9b1594ee62c336adc3aa430d4c1cf62bd51e](https://github.com/electron/electron/commit/079b9b1594ee62c336adc3aa430d4c1cf62bd51e)
- [https://github.com/electron/electron/commit/0e6aca0618eeae50a18cfd50548b8688820629ed](https://github.com/electron/electron/commit/0e6aca0618eeae50a18cfd50548b8688820629ed)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)