CVE-2026-102673High· 8.2▾ TwilightElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, includ…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.
electron < 39.8.8electron >= 40.0.0, < 40.9.0electron >= 41.0.0, <= 41.2.1electron = 42.0.0Upgrade past the affected range:
electron 40.9.0Affected packages:
electron < 41.10.4electron >= 42.0.0-alpha.1, < 42.5.2electron >= 43.0.0-alpha.1, < 43.0.0Patched in:
electron 41.10.4electron 42.5.2electron 43.0.0Source: https://github.com/advisories/GHSA-hq2x-r82h-9wj4
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102674High· 8.2Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102675High· 7.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102677High· 7.8Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102676High· 8.3Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin