CVE-2026-102673: Electron Electron Drops Inherited HTML Sandbox Vulnerability

HIGH
Advisory Identifier: GHSA-hq2x-r82h-9wj4
Share
CVSS 8.2
CWE-693 CWE-346
Published
Advisory Summary

CVE-2026-102673 is a HIGH (CVSS 8.2) electron drops inherited html sandbox vulnerability (CWE-693: Protection Mechanism Failure) affecting Electron libraries in the npm ecosystem. The issue involves electron drops inherited html sandbox restrictions for popups opened through openurlfromtab. Remediation is available by upgrading affected packages to version 41.10.4, 42.5.2, 43.0.0.

CVE-2026-102673 at a Glance

CVE Identifier CVE-2026-102673
GHSA Identifier GHSA-hq2x-r82h-9wj4
Severity HIGH
CVSS v3.1 Base Score 8.2
CWE Classification CWE-693: Protection Mechanism Failure
Affected Product Electron
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 8.2

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2026-102673

To remediate this vulnerability, upgrade all affected Electron dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

electron fixed: 41.10.4 
npm install electron@41.10.4
electron fixed: 42.5.2 
npm install electron@42.5.2
electron fixed: 43.0.0 
npm install electron@43.0.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls electron

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-102673, inspect your project dependencies using npm:

npm ls electron

Analyze the terminal output to locate any version of Electron in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 41.10.4), your application is affected.

Note: The npm ls electron command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-693: Protection Mechanism Failure, where the product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. In Electron, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Popups opened from a sandboxed iframe through a link (for example `target="_blank"` or a middle-click) did not inherit the iframe's HTML `sandbox` restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining access to that origin's cookies, storage, and same-origin scripting. Apps are only affected if they embed untrusted content in iframes sandboxed with `allow-scripts allow-popups`. Apps that do not embed untrusted content in sandboxed iframes are not affected. ### Workarounds Use `setWindowOpenHandler` on the parent `WebContents` to deny or constrain popups opened from sandboxed frames, or do not apply `allow-popups` to sandboxed iframes that render untrusted content. ### Fixed Versions * `43.0.0` * `42.5.2` * `41.10.4` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

CVE-2026-102673 Affected Electron Versions

3 component(s)
Fixed Versions:
41.10.442.5.243.0.0
Product / Package Ecosystem Affected Versions Fixed Version
electron
npm/electron
npm
< 41.10.4
41.10.4
electron
npm/electron
npm
≥ 42.0.0-alpha.1
< 42.5.2
42.5.2
electron
npm/electron
npm
≥ 43.0.0-alpha.1
< 43.0.0
43.0.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4
Electron Source Repository REPOSITORY
https://github.com/electron/electron/pull/52133
Security Fix Commit FIX COMMIT
https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba
Security Fix Commit FIX COMMIT
https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69
Security Fix Commit FIX COMMIT
https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da
Electron Source Repository REPOSITORY
https://github.com/electron/electron
Electron Release RELEASE
https://github.com/electron/electron/releases/tag/v41.10.4
Electron Release RELEASE
https://github.com/electron/electron/releases/tag/v42.5.2
Electron Release RELEASE
https://github.com/electron/electron/releases/tag/v43.0.0

Frequently Asked Questions

What is CVE-2026-102673?
CVE-2026-102673 is a security vulnerability in Electron involving Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab under CWE-693: Protection Mechanism Failure.
Which Electron versions are affected?
Affected versions include releases prior to 41.10.4, 42.5.2, 43.0.0 across affected packages: electron.
What version fixes CVE-2026-102673?
Upgrading to 41.10.4, 42.5.2, 43.0.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is electron affected?
Yes, electron is affected in releases prior to 41.10.4, 42.5.2, 43.0.0. Upgrade your dependency to 41.10.4, 42.5.2, 43.0.0 or later.
What is the CVSS score of CVE-2026-102673?
CVE-2026-102673 has a CVSS v3.1 base score of 8.2 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N.
What CWE is associated with CVE-2026-102673?
CVE-2026-102673 is classified under CWE-693: Protection Mechanism Failure (The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.).
How can I check npm dependencies for CVE-2026-102673?
Run the dependency tree command: 'npm ls electron'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hq2x-r82h-9wj4",
  "modified" : "2026-09-29T18:05:35Z",
  "published" : "2026-09-29T18:05:34Z",
  "aliases" : [ "CVE-2026-102673" ],
  "summary" : "Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab",
  "details" : "### Impact\n\nPopups opened from a sandboxed iframe through a link (for example `target=\"_blank\"` or a middle-click) did not inherit the iframe's HTML `sandbox` restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining access to that origin's cookies, storage, and same-origin scripting.\n\nApps are only affected if they embed untrusted content in iframes sandboxed with `allow-scripts allow-popups`. Apps that do not embed untrusted content in sandboxed iframes are not affected.\n\n### Workarounds\n\nUse `setWindowOpenHandler` on the parent `WebContents` to deny or constrain popups opened from sandboxed frames, or do not apply `allow-popups` to sandboxed iframes that render untrusted content.\n\n### Fixed Versions\n\n* `43.0.0`\n* `42.5.2`\n* `41.10.4`\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "electron"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "41.10.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "electron"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "42.0.0-alpha.1"
      }, {
        "fixed" : "42.5.2"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "electron"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "43.0.0-alpha.1"
      }, {
        "fixed" : "43.0.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/pull/52133"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/electron/electron"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/releases/tag/v41.10.4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/releases/tag/v42.5.2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/electron/electron/releases/tag/v43.0.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-346", "CWE-693" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-29T18:05:34Z",
    "nvd_published_at" : null
  }
}