Executive brief
Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw allowed different parts of an application to incorrectly access windows opened by other parts of the app if they shared the same name. In specific configurations, this could allow less-trusted content to hijack a window with higher privileges, potentially leading to unauthorized data access or, in extreme cases, full control over the user's computer.
Technical details
A vulnerability in Electron's window management arises because window.open() lookups for named targets were not correctly scoped to the opener's browsing context group. An attacker-controlled renderer can navigate a child window created by a different, unrelated renderer by using a matching target name. If the target child window was configured with elevated webPreferences (such as privileged preload scripts or disabled sandboxing) via setWindowOpenHandler, the newly navigated content inherits these elevated permissions. This can lead to privilege escalation or arbitrary code execution if nodeIntegration is enabled or the sandbox is disabled. The issue is fixed in versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.
Affected products
- ElectronJS Electron < 39.8.5, 40.x < 40.8.5, 41.x < 41.1.0, 42.0.0-alpha.1 < 42.0.0-alpha.5
Timeline
- 2026-04-06: advisory: GitHub Advisory GHSA-f3pv-wv63-48x8 published
- 2026-04-07: disclosed: CVE-2026-34765 published