ZeroDay Findings
Sign inSign up

Findings

CVE-2026-102674

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

Published Sep 29, 2026 · updated Oct 15, 2026 · electronjs electron

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 29, 2026 · NIST NVD

    Detected

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the

  2. Oct 15, 2026 · NIST NVD

    Updated

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the

Affected

  • cpe electronjs/electronversion unspecified
  • cpe electronjs/electron44.0.0

Sources

  • CVE.orgVulnerability recordCVE-2026-102674

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-102674

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2026-102674

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrus

    nvd.nist.gov

References