~ / search / GHSA-v93f-fgjr-hjrj

GHSA-v93f-fgjr-hjrj

Electron: window.open features string controls some window options considered privileged

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-70607

Packages

EcosystemPackageAffectedFixed in
npm electron < 39.8.8 39.8.8
npm electron >= 40.0.0-alpha.1, < 40.9.0 40.9.0
npm electron >= 41.0.0-alpha.1, < 41.2.1 41.2.1
npm electron >= 42.0.0-alpha.1, < 42.0.0-beta.3 42.0.0-beta.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Some window options supplied by web content in the `window.open()` features string were applied to the new `BrowserWindow` without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths. Apps are only affected if untrusted content can call `window.open()` and the app does not override child window options via `setWindowOpenHandler`. Apps that deny `window.open()` for untrusted content, or set `overrideBrowserWindowOptions` explicitly, are not affected. ### Workarounds Return `{ action: 'deny' }` from `setWindowOpenHandler` for untrusted content, or supply `overrideBrowserWindowOptions` so every window option is set explicitly. ### Fixed Versions * `42.0.0-beta.3` * `41.2.1` * `40.9.0` * `39.8.8` ### For more information If you have any questions or comments about this advisory, email Electron at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.