~ / search / GHSA-hq2x-r82h-9wj4

GHSA-hq2x-r82h-9wj4

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Source: GitHub Advisory Database (reviewed) High CVE-2026-102673

Packages

EcosystemPackageAffectedFixed in
npm electron < 41.10.4 41.10.4
npm electron >= 42.0.0-alpha.1, < 42.5.2 42.5.2
npm electron >= 43.0.0-alpha.1, < 43.0.0 43.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Popups opened from a sandboxed iframe through a link (for example `target="_blank"` or a middle-click) did not inherit the iframe's HTML `sandbox` restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining access to that origin's cookies, storage, and same-origin scripting. Apps are only affected if they embed untrusted content in iframes sandboxed with `allow-scripts allow-popups`. Apps that do not embed untrusted content in sandboxed iframes are not affected. ### Workarounds Use `setWindowOpenHandler` on the parent `WebContents` to deny or constrain popups opened from sandboxed frames, or do not apply `allow-popups` to sandboxed iframes that render untrusted content. ### Fixed Versions * `43.0.0` * `42.5.2` * `41.10.4` ### For more information If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.