Electron CVE-2026-102676

Exploitation requires a specific, non-default Electron deployment: the application must (1) enable the <webview> tag, (2) run the embedder UNSANDBOXED (sandbox:false) with Node integration disabled, and (3) load untrusted or attacker-controllable content into the guest. Given those, the guest sets 'nodeIntegrationInWorker' (e.g. via the webpreferences attribute) to spawn a Node-capable Web Worker. Limiting factors that reduce real-world exposure: apps that never enable <webview>, apps that keep the embedder sandboxed, or apps that only load trusted first-party content are NOT affected. Workarounds confirmed by the vendor: strip nodeIntegrationInWorker from guest preferences in a 'will-attach-webview' handler, or avoid the <webview> tag for untrusted content.

Signals conflict sharply here. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) and 9.8 score portray a trivially remotely exploitable, unauthenticated flaw, but the description and GHSA advisory impose hard preconditions that CVSS does not capture: the application must enable the <webview> tag AND run an unsandboxed embedder AND load untrusted guest content. CISA SSVC rates Exploitation as 'none' and Automatable as 'no', while Technical Impact is 'total' (Node.js worker = arbitrary code execution). EPSS is low (0.45%, 37th percentile), there is no CISA KEV listing, and no public exploit was identified - only vendor regression-test code ships in the patch. The honest read: this is a genuinely high-impact privilege-escalation bug (CWE-269) but NOT a widespread drive-by threat. The 9.8 overstates real-world urgency because it ignores the non-default configuration requirement; SSVC's 'none/no/total' is more representative. Priority should be HIGH for the subset of Electron apps that use <webview> with an unsandboxed embedder and render untrusted content, and LOW for everyone else. Note explicitly: CVSS says AC:L/PR:N, but exploitation depends on an operator-chosen, non-default embedder configuration - verify your app's webPreferences before deprioritizing or prioritizing.

An Electron app enables the <webview> tag with an unsandboxed embedder (nodeIntegration disabled) and loads attacker-controlled or compromised web content into the guest. The malicious guest page sets nodeIntegrationInWorker via its webpreferences and spawns a Web Worker that gains Node.js 'require', escalating beyond the privilege the embedder intended and achieving host-level code execution. No public weaponized exploit exists, but the vendor advisory includes a proof-of-concept regression test demonstrating the worker obtaining Node access.