Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
Five high-severity Electron vulnerabilities, including CVE-2026-102676, CVE-2026-102673 and CVE-2026-102674, weaken sandbox isolation. Update Electron now. #Electron #ElectronJS #CVE2026102676 #AppSecurity #Sandbox #JavaScript #DesktopApps #PatchNow https://securityonline.info/electron-vulnerabilities-sandbox-bypass/
🔴 Electron, #HTML Sandbox Restriction Bypass, #CVE-2026-102673 (High) -DC-Sep2026-2625 https://dailycve.com/electron-html-sandbox-restriction-bypass-cve-2026-102673-high-dc-sep2026-2625/