EUVD-2026-53432
GHSA-x8rc-wpg4-grpf
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
AC:H reflects mandatory non-default app architecture; UI:R for required victim interaction; I:L only since impact is visual UI spoofing without data exfiltration or availability loss.
Primary rating from Vendor (https://github.com/electron/electron).
CVSS VectorVendor: https://github.com/electron/electron
Lifecycle Timeline
4DescriptionCVE.org
Impact
The native autofill popup could be positioned by a cross-origin iframe outside that iframe's bounds, over the embedding page's UI, enabling clickjacking or spoofing of trusted UI.
Apps are only affected if they embed untrusted content in iframes within windows that also display trusted UI. Apps that do not embed untrusted third-party content are not affected.
Workarounds
Do not embed untrusted content in iframes inside windows that display trusted UI.
Fixed Versions
42.0.0-beta.341.2.140.9.039.8.8
For more information
If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org)
AnalysisAI
Cross-origin iframe autofill popup positioning in Electron allows a malicious iframe to render the native autofill popup outside its own bounds, overlapping the embedding application's trusted UI and enabling clickjacking or UI spoofing attacks. Affected are only Electron applications that deliberately embed untrusted cross-origin iframes within windows that also present trusted native UI - apps without such patterns are explicitly not at risk. No public exploit code has been identified at time of analysis, and the vendor-confirmed CVSS score of 3.1 (Low) reflects the high attack complexity and constrained impact, though the nature of the spoofing risk makes it qualitatively more dangerous than the score alone suggests for vulnerable app architectures.
Technical ContextAI
Electron is an open-source framework (npm/electron) that bundles Chromium and Node.js to build cross-platform desktop applications. CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) identifies the root cause: the native autofill popup - a privileged OS-level UI element rendered outside the standard web content compositor - fails to enforce that its screen position remains within the bounds of the iframe that triggered it. Because the autofill popup is drawn by the host OS or Electron's native layer rather than by the web renderer, same-origin boundary enforcement does not automatically apply to its positioning. A cross-origin iframe can therefore supply positioning hints that cause the popup to appear over arbitrary regions of the parent window's trusted UI, including buttons, dialogs, or form fields owned by the embedding application. This is distinct from traditional XSS; no script execution is involved - only visual overlay and interaction hijacking via a UI layer ordering violation.
RemediationAI
Upgrade Electron to one of the vendor-confirmed fixed versions: 39.8.8 (stable 39.x branch), 41.2.1 (stable 41.x branch), 40.9.0 or 40.9.1 (verify exact fix version against the Electron changelog for the 40.x branch), or 42.0.0-beta.3 (pre-release 42.x). The upstream security advisory is at https://github.com/electron/electron/security/advisories/GHSA-x8rc-wpg4-grpf and the GitHub Advisory Database entry is https://github.com/advisories/GHSA-x8rc-wpg4-grpf. If immediate upgrade is not feasible, the vendor-endorsed workaround is to avoid embedding untrusted cross-origin content in iframes within any Electron window that also displays trusted application UI; this may be achievable by isolating untrusted iframe content in dedicated, separate BrowserWindow instances with no shared trusted UI. Note that this architectural separation may require non-trivial refactoring if untrusted iframes are currently co-located with privileged UI by design. Contact security@electronjs.org for vendor guidance on specific deployment scenarios.
Share
External POC / Exploit Code
Leaving vuln.today