{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102673", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T16:10:04.075Z", "datePublished": "2026-09-29T16:38:41.946Z", "dateUpdated": "2026-09-30T20:11:08.290Z"}, "containers": {"cna": {"title": "Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4"}, {"name": "https://github.com/electron/electron/pull/52133", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/pull/52133"}, {"name": "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba"}, {"name": "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69"}, {"name": "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da"}, {"name": "https://github.com/electron/electron/releases/tag/v41.10.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v41.10.4"}, {"name": "https://github.com/electron/electron/releases/tag/v42.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v42.5.2"}, {"name": "https://github.com/electron/electron/releases/tag/v43.0.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v43.0.0"}], "affected": [{"vendor": "electron", "product": "electron", "versions": [{"version": "< 41.10.4", "status": "affected"}, {"version": ">= 42.0.0-alpha.1, < 42.5.2", "status": "affected"}, {"version": ">= 43.0.0-alpha.1, < 43.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T16:38:41.946Z"}, "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0."}], "source": {"advisory": "GHSA-hq2x-r82h-9wj4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102673", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T19:34:09.694143Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:11:08.290Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab", "source": {"advisory": "GHSA-hq2x-r82h-9wj4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "electron", "product": "electron", "versions": [{"status": "affected", "version": "< 41.10.4"}, {"status": "affected", "version": ">= 42.0.0-alpha.1, < 42.5.2"}, {"status": "affected", "version": ">= 43.0.0-alpha.1, < 43.0.0"}]}], "references": [{"url": "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4", "name": "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/electron/electron/pull/52133", "name": "https://github.com/electron/electron/pull/52133", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba", "name": "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69", "name": "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da", "name": "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v41.10.4", "name": "https://github.com/electron/electron/releases/tag/v41.10.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v42.5.2", "name": "https://github.com/electron/electron/releases/tag/v42.5.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v43.0.0", "name": "https://github.com/electron/electron/releases/tag/v43.0.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T16:38:41.946Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102673", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T19:34:09.694143Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-30T19:33:53.702Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-102673", "state": "PUBLISHED", "dateUpdated": "2026-09-29T16:38:41.946Z", "dateReserved": "2026-09-29T16:10:04.075Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-29T16:38:41.946Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "electron", "vendor": "electron", "versions": [{"status": "affected", "version": "< 41.10.4"}, {"status": "affected", "version": ">= 42.0.0-alpha.1, < 42.5.2"}, {"status": "affected", "version": ">= 43.0.0-alpha.1, < 43.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "94E93D1A-EB27-460E-8A0E-C3D6AD775994", "versionEndExcluding": "39.8.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "56E4CE6E-6A00-4DF6-A720-141D67D4CA2D", "versionEndExcluding": "40.9.0", "versionStartIncluding": "40.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "751C3E3A-F353-4132-B199-92C1FD547F31", "versionEndIncluding": "41.2.1", "versionStartIncluding": "41.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "498062D8-5C83-4FC2-A04B-94F3228B2BED", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "A272F9F4-AB62-407C-B1A8-18586A474C19", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "BF49E260-9653-4D26-8B6C-C6FAFE697F5A", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "2F3B609A-0CA5-4E8C-865E-CF79B6B0CCCC", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "308A710A-7965-40A0-87E4-2B66A8CEF87A", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "6CFEB6F4-A38A-43BC-92B1-2E1DC8BBD1D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:beta1:*:*:*:node.js:*:*", "matchCriteriaId": "7B9FD9F4-48E0-4EA2-957D-57ADA2A3D42A", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:beta2:*:*:*:node.js:*:*", "matchCriteriaId": "62E12D3F-154E-44AB-919F-0E34E970C2CB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0."}], "id": "CVE-2026-102673", "lastModified": "2026-10-15T14:01:06.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102673", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T19:34:09.694143Z", "version": "2.0.3"}}]}, "published": "2026-09-29T17:17:07.487", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/electron/electron/pull/52133"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/electron/electron/releases/tag/v41.10.4"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v42.5.2"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v43.0.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "electron: Electron: Sandbox bypass via popups opened from sandboxed iframes", "id": "2543311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543311"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-281", "details": ["Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.", "A flaw was found in Electron. When a popup window is opened from an embedded web frame (iframe) using navigation actions such as opening a link in a new tab, the popup fails to inherit the frame's sandbox security restrictions. A remote attacker controlling untrusted content within a sandboxed frame can exploit this issue to open a popup under the host application's security origin. This flaw primarily leads to information disclosure and unauthorized scripting, exposing sensitive application data such as cookies and storage."], "mitigation": {"lang": "en:us", "value": "Avoid embedding untrusted web content inside sandboxed iframes configured with allow-popups, or intercept new window navigation requests using setWindowOpenHandler to validate and deny unexpected popup requests."}, "name": "CVE-2026-102673", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Affected", "package_name": "rh-podman-desktop", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "podman-desktop", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rh-podman-desktop", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-09-29T16:38:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102673\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102673\nhttps://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba\nhttps://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69\nhttps://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da\nhttps://github.com/electron/electron/pull/52133\nhttps://github.com/electron/electron/releases/tag/v41.10.4\nhttps://github.com/electron/electron/releases/tag/v42.5.2\nhttps://github.com/electron/electron/releases/tag/v43.0.0\nhttps://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4"], "statement": "A flaw was found in Electron where popup windows opened from a sandboxed iframe via navigation actions (such as target=\"_blank\" links or middle-clicks) fail to inherit the iframe's sandbox security restrictions. An attacker controlling untrusted content in a sandboxed iframe configured with allow-scripts and allow-popups can exploit this issue to open a popup running under the embedding application's full origin, exposing sensitive data such as cookies, storage, and same-origin scripting capabilities.", "threat_severity": "Important"}