HIGH 7.2 GitHub
CVE-2026-70608
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
### Impact
A sandboxed iframe without the `allow-popups` keyword could still open a new window (or trigger `setWindowOpenHandler`) with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction.
Apps that embed untrusted content in sandboxed iframes and rely on the absence of `allow-popups` to prevent window creation are affected. Apps that deny window creation in `setWindowOpenHandler`, or that do not embed untrusted content
Affected Products
- npm/electron >= 42.0.0-alpha.1, < 42.0.1
- npm/electron >= 40.0.0-alpha.1, < 41.10.3
- npm/electron < 39.8.10
References
- https://github.com/advisories/GHSA-9f4c-93c8-jc8g
- https://github.com/electron/electron/security/advisories/GHSA-9f4c-93c8-jc8g
- https://github.com/electron/electron/pull/51437
- https://github.com/electron/electron/pull/51438
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-08-05 via GitHub. Affected: npm/electron >= 42.0.0-alpha.1, < 42.0.1, npm/electron >= 40.0.0-alpha.1, < 41.10.3, npm/electron < 39.8.10.
vulnfeed aggregates 9316 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.