CVE-2026-102674: Electron Package Vulnerability - Inherited Sandbox Restrictions Not Applied
Summary
CVE-2026-102674: Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions. Affects electron across 4 version ranges.
< 41.10.6
>= 42.0.0-alpha.1, < 42.9.2
>= 43.0.0-alpha.1, < 43.4.1
>= 44.0.0-alpha.1, < 44.0.0-beta.5
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as JavaScript, HTML, and CSS. It combines the Chromium rendering engine and the Node.js runtime, enabling developers to create rich desktop applications that can run on Windows, macOS, and Linux. This vulnerability arises from a flaw in how Electron handles sandboxed top-level documents, potentially exposing applications to security risks when rendering untrusted content.
Vulnerability Detail
The vulnerability occurs when windows are opened from a sandboxed top-level document that does not inherit the HTML sandbox restrictions. This means that content intended to be sandboxed can open a window with the application's full origin, leading to potential security breaches. Apps that render untrusted content in a sandboxed environment and allow popups are particularly at risk. The issue is compounded by the fact that it affects the security model of the application, allowing untrusted content to bypass intended restrictions.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 41.10.641.10.6npm install electron@41.10.6 -
>= 42.0.0-alpha.1, < 42.9.242.9.2npm install electron@42.9.2 -
>= 43.0.0-alpha.1, < 43.4.143.4.1npm install electron@43.4.1 -
>= 44.0.0-alpha.1, < 44.0.0-beta.544.0.0-beta.5npm install electron@44.0.0-beta.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can deny popups from untrusted content by implementing the following code in your Electron application:
app.on('web-contents-created', (event, contents) => {
contents.on('new-window', (event) => {
event.preventDefault(); // Deny the new window
});
});
Conclusion
In summary, CVE-2026-102674 is a significant vulnerability in the Electron package that affects applications rendering untrusted content in sandboxed top-level documents. It is crucial to update to the patched versions or implement the provided workaround to mitigate potential security risks.
See every vulnerability recorded for electron →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
Failing to address this vulnerability may expose your application to security risks, allowing untrusted content to execute actions with the application's full origin.
If you cannot update to the patched version, implement the provided workaround to deny popups from untrusted content until you can perform the update.
For more information, you can visit the Electron security documentation or contact the Electron security team at security@electronjs.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
