PkgSeer

Vulnerability GHSA-gr2m-v5gq-v685

High Risk
HIGH RISK
CVSS Score: 8.2
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
22 days ago
September 29, 2026 at 06:05 PM UTC
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4

Summary

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Details

Impact

Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes.

Apps are only affected if they render untrusted content in a sandboxed top-level document that allows popups. Apps that deny popups from untrusted content with setWindowOpenHandler are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content.

Fixed Versions

  • 44.0.0-beta.5
  • 43.4.1
  • 42.9.2
  • 41.10.6

For more information

If you have any questions or comments about this advisory, email us at [email protected]

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk
2 hours ago
Electron: HID and USB permission checks can be attributed to the wrong origin
0.1.0 - 42.11.2 and 43.0.0-alpha.1 - 43.6.0 and 44.0.0-alpha.1 - 44.2.0 and 45.0.0-alpha.1 - 45.0.0-alpha.4 GHSA-fw47-9c62-h3vw
0.1.0 - 42.11.2 and 43.0.0-alpha.1 - 43.6.0 and 44.0.0-alpha.1 - 44.2.0 and 45.0.0-alpha.1 - 45.0.0-alpha.4 GHSA-fw47-9c62-h3vw
Medium Risk
22 days ago
Electron: Local race condition in Squirrel.Mac update installation on macOS
0.1.0 - 39.8.9 and 40.0.0-alpha.2 - 41.10.4 and 42.0.0-alpha.1 - 42.0.0-beta.1 GHSA-vv43-5jgx-7qv8
0.1.0 - 39.8.9 and 40.0.0-alpha.2 - 41.10.4 and 42.0.0-alpha.1 - 42.0.0-beta.1 GHSA-vv43-5jgx-7qv8
High Risk
22 days ago
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
0.1.0 - 41.10.3 and 42.0.0-alpha.1 - 42.5.1 and 43.0.0-alpha.1 - 43.0.0-beta.8 GHSA-hq2x-r82h-9wj4
0.1.0 - 41.10.3 and 42.0.0-alpha.1 - 42.5.1 and 43.0.0-alpha.1 - 43.0.0-beta.8 GHSA-hq2x-r82h-9wj4
High Risk
22 days ago
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-j84w-jfhq-vhvj
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-j84w-jfhq-vhvj
High Risk
22 days ago
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-9qh4-3jw8-366w
0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-9qh4-3jw8-366w
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
22 days ago
September 29, 2026 at 06:05 PM UTC
Fixed (43.4.1)
2 months ago
August 19, 2026 at 01:44 AM UTC
Fixed (41.10.6)
Unknown
Unknown
Fixed (42.9.2)
Unknown
Unknown
Fixed (44.0.0-beta.5)
Unknown
Unknown
Last Modified
22 days ago
September 29, 2026 at 06:15 PM UTC