Electron CVE-2026-102673

Requires the target Electron application (prior to 41.10.4 / 42.5.2 / 43.0.0) to embed UNTRUSTED web content inside an HTML sandboxed iframe configured with the 'allow-scripts allow-popups' keywords but WITHOUT 'allow-popups-to-escape-sandbox'. Exploitation is triggered when that iframe opens a popup via Electron's OpenURLFromTab navigation path - specifically links using target="_blank" or a middle-click - which then fails to inherit the parent's sandbox restrictions and receives the embedding application's full origin. Limiting factors: the flaw is inert for applications that do not embed untrusted content in sandboxed iframes (explicitly stated unaffected); it requires the specific non-default iframe sandbox configuration; and CVSS marks UI:R, reflecting that a middle-click path needs user interaction (though scripted target=_blank popups reduce that dependency).

This is a legitimate but conditionally-scoped issue in an extremely widely-deployed framework. The vendor CVSS3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N = 8.2) is internally consistent with the described impact: a scope-changing (S:C) origin-boundary breach where content isolated in a sandboxed iframe escapes to the embedding application's full origin, exposing cookies, storage (C:H) and enabling same-origin scripting (I:L). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not a widespread-exploitation emergency. The score is meaningfully gated by a non-default precondition that CVSS base metrics do not capture: the affected application must itself embed UNTRUSTED content inside a sandboxed iframe configured with 'allow-scripts allow-popups' (and without 'allow-popups-to-escape-sandbox'). The description explicitly states applications not embedding untrusted content in sandboxed iframes are unaffected, so real-world exposure is far narrower than the ubiquity of Electron would suggest. PR:N is appropriate because the attacker is the untrusted embedded web content, not an authenticated app user. Bottom line: real but targeted - prioritize for Electron apps that render third-party/untrusted web content in sandboxed iframes; deprioritize for apps that only load trusted first-party content.

An Electron application embeds untrusted third-party web content in a sandboxed iframe using 'allow-scripts allow-popups'. Attacker-controlled script in that iframe opens a popup via target="_blank" (or lures a middle-click) through the OpenURLFromTab path; the popup loads without inheriting the iframe's sandbox flags, running with the embedding application's full origin. The attacker's popup content then reads that origin's cookies and storage and performs same-origin scripting. No public POC is identified in the provided data.