Executive brief
Electron is a framework used to build desktop applications using web technologies. A vulnerability exists where untrusted content loaded in a restricted 'sandbox' could bypass security settings to open unauthorized new windows without any user interaction. This could allow malicious content to perform phishing attacks or interact with other parts of the application that were intended to be isolated.
Technical details
A protection mechanism failure (CWE-693) exists in Electron where sandboxed iframes lacking the 'allow-popups' attribute can still trigger new window creation. This occurs because navigations following the OpenURL path fail to check and apply the iframe's sandbox popup restrictions. An attacker providing untrusted content to be rendered in a sandboxed iframe can exploit this to open new windows or trigger 'setWindowOpenHandler' without user interaction. The issue is fixed in versions 39.8.10, 41.10.3, and 42.0.1. Developers can also mitigate this by explicitly denying untrusted window creation requests in 'setWindowOpenHandler'.
Affected products
- Electron Electron < 39.8.10, >= 40.0.0-alpha.1, < 41.10.3, >= 42.0.0-alpha.1, < 42.0.1
Timeline
- 2026-07-27: disclosed: Initial disclosure by MarshallOfSound
- 2026-08-05: advisory: GitHub Advisory published
- 2026-08-05: patched