Microsoft CVE-2026-34765

CVSS 6.0 (AC:H - attack complexity is high because the attacker must satisfy multiple preconditions) combined with CVSS vector PR:L (authenticated attacker; in Electron context, this means the attacker must control a renderer process, typically via loading untrusted web content) and S:C (scope change - the vulnerability allows escaping normal renderer isolation) yields a moderate-to-high real-world risk for vulnerable applications. However, the actual attack surface is significantly constrained: the vulnerability only affects applications that (1) open multiple top-level windows with different trust levels, (2) use setWindowOpenHandler to grant child windows elevated webPreferences, and (3) load untrusted content in at least one renderer. Applications using a single top-level window, or those that do not elevate child window permissions, are unaffected. The RCE tag is only realized if child windows are granted nodeIntegration:true or sandbox:false (explicitly discouraged by Electron security guidance), suggesting many real-world applications may be partially protected by developers following security best practices. The high CVSS AC:H rating and restrictive impact conditions suggest this is a genuine but not universal priority vulnerability.

An attacker controls a renderer process in a multi-window Electron application (e.g., by hosting untrusted web content in a content/preview window). The attacker calls window.open() with the same target name as a child window that was previously opened by a different, trusted renderer (e.g., a settings or admin panel). Because the lookup is not scoped to the original opener's context, the attacker's call hijacks and navigates the trusted child window to attacker-controlled content. If that trusted child window was granted elevated webPreferences such as a privileged preload script by setWindowOpenHandler, the attacker's content inherits those permissions and can execute arbitrary code with the privileges of the preload script. No public exploit code is known at time of analysis, but the attack only requires basic JavaScript knowledge and control of a single untrusted renderer.