EUVD-2026-53462
GHSA-v93f-fgjr-hjrj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker delivers malicious web content to vulnerable Electron app
-
DeliveryRenderer executes window.open() with crafted features string
-
ExploitFeatures string includes privileged option (e.g., icon=/etc/passwd)
-
ExecutionUnvalidated options forwarded to main process BrowserWindow constructor
-
PersistMain process accesses attacker-chosen file or network path
-
ImpactLimited information disclosure or filesystem path probing achieved
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires two simultaneous application-level conditions to be met: untrusted web content must be permitted to call window.open() within the Electron application (meaning the app loads third-party, user-supplied, or otherwise uncontrolled URLs in a BrowserWindow or WebContents), AND the application must not implement setWindowOpenHandler returning { action: 'deny' } or supplying overrideBrowserWindowOptions for those windows. Apps that load exclusively first-party or fully trusted content are not affected. Apps that deny window.open() globally for external content are not affected. Apps that explicitly set overrideBrowserWindowOptions are not affected. The CVSS PR:N reflects that no Electron application authentication is required from the attacker - only the ability to execute JavaScript in the renderer under the conditions above. Exploitation impact is bounded to main-process access of attacker-specified file or network paths (e.g., via the icon option), yielding path probing or limited file read side effects, not arbitrary code execution. |
| Impact | The provided CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) correctly characterizes the attacker position - no authentication to the Electron app is required, and the vector is network-reachable via the delivered web content - but overstates simplicity for most deployments. Real-world exploitation is gated on two simultaneous app-level conditions: the app must serve untrusted web content and must omit setWindowOpenHandler, making the effective attack surface narrower than a raw AV:N/AC:L reading implies. Impact is bounded to limited confidentiality loss (main process probing or accessing attacker-specified paths); there is no direct code execution, integrity, or availability impact identified. No EPSS data was included in the provided intelligence, no CISA KEV listing exists, and no POC has been published, all indicating low opportunistic exploitation pressure at this time. The realistic priority tier is medium for Electron apps that display third-party URLs (browser shells, chat clients, web-view-heavy tools) and low for apps loading exclusively first-party content. |
| Exploit ScenarioDerived | An attacker hosts a malicious page that is loaded inside an Electron application which permits untrusted URLs to spawn child windows - such as a web-browsing shell or a chat client that renders external links inline. The attacker's page executes window.open('https://attacker.example', '_blank', 'icon=/etc/shadow,width=400'), causing the Electron main process to attempt to resolve /etc/shadow as a window icon resource, probing or partially reading attacker-specified filesystem paths without any user interaction beyond the initial page load. No public exploit code exists at time of analysis, but the technique requires only standard JavaScript available in any renderer context. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Electron's window.open() features string parsing forwards untrusted BrowserWindowConstructorOptions directly to child BrowserWindows without an allowlist, allowing renderer-side web content to supply privileged options - such as icon - that cause the trusted main process to access attacker-chosen file or network paths. All Electron apps serving untrusted web content without a setWindowOpenHandler guard are affected across the 39.x, 40.x, 41.x, and 42.x beta series. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the practical attack surface is narrowed to apps that load third-party or user-controlled content and omit the recommended setWindowOpenHandler override.
RemediationAI
Upgrade Electron to a patched release: 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3, available at the respective GitHub release pages (e.g., https://github.com/electron/electron/releases/tag/v41.2.1 for the 41.x line). If an immediate upgrade is not feasible, implement setWindowOpenHandler in the main process and return { action: 'deny' } for any window.open() call originating from untrusted content - this blocks the vulnerable code path entirely but will prevent any child windows from opening, which may break app functionality. Where child windows are required, instead supply overrideBrowserWindowOptions within the setWindowOpenHandler return value to explicitly set every relevant BrowserWindow option, ensuring renderer-supplied values are overwritten and cannot influence privileged parameters. The overrideBrowserWindowOptions approach preserves functionality while eliminating the attack path, making it the preferred workaround over blanket denial.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Electron (pkg:npm/electron) wraps Chromium and Node.js to build cross-platform desktop applications, with a split trust model: the renderer process handles web content and is considered untrusted, while the main process holds privileged OS access. Child windows spawned via window.open() accept a comma-separated features string that Electron's parseFeatures() function in lib/browser/parse-features-string.ts parsed into BrowserWindowConstructorOptions and forwarded verbatim to the new BrowserWindow constructor. Because BrowserWindowConstructorOptions includes options like icon that trigger main-process filesystem or network I/O, a malicious renderer could inject these into the features string, bypassing the renderer/main process trust boundary. The root cause is CWE-20 (Improper Input Validation): the absence of an allowlist meant all parsed options from untrusted renderer content reached a privileged API surface. The fix introduces a hardcoded allowedWindowOptions Set in parse-features-string.ts that permits only presentational options (width, height, title, backgroundColor, frame, etc.) and silently drops any option with filesystem or network side effects.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-delivered renderer content requires no auth; impact limited to main process accessing attacker-chosen paths, yielding partial confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (https://github.com/electron/electron).
CVSS VectorVendor: https://github.com/electron/electron
DescriptionCVE.org
Impact
Some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths.
Apps are only affected if untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler. Apps that deny window.open() for untrusted content, or set overrideBrowserWindowOptions explicitly, are not affected.
Workarounds
Return { action: 'deny' } from setWindowOpenHandler for untrusted content, or supply overrideBrowserWindowOptions so every window option is set explicitly.
Fixed Versions
42.0.0-beta.341.2.140.9.039.8.8
For more information
If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB