Executive brief
Electron, a framework used to build desktop applications, is vulnerable to a user interface flaw where untrusted content can manipulate native popups. An attacker could position an autofill popup over legitimate parts of the application's interface, potentially tricking users into clicking something they did not intend to or spoofing trusted information. This issue only affects applications that embed untrusted third-party content within the same window as sensitive or trusted user interface elements.
Technical details
A vulnerability classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) exists in Electron. The root cause is a failure to restrict the positioning of native autofill popups when triggered by cross-origin iframes. A remote attacker can exploit this by embedding malicious content in an iframe, which then positions the native popup over the parent window's trusted UI. This requires user interaction and is only applicable to apps that mix untrusted content with trusted UI in the same window. Patches are available in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Affected products
- Electron electron < 39.8.8, >= 40.0.0-alpha.1, < 40.9.0, >= 41.0.0-alpha.1, < 41.2.1, >= 42.0.0-alpha.1, < 42.0.0-beta.3
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory