Electron CVE-2026-70608

Exploitation requires the Electron application to actively embed untrusted or third-party HTML content inside a sandboxed iframe where the sandbox attribute omits the allow-popups keyword (for example, sandbox='allow-scripts'). The application must also not have a setWindowOpenHandler that returns { action: 'deny' } for untrusted content - apps that do are explicitly not affected per the advisory. No user interaction is required; the iframe JavaScript can trigger the bypass automatically on page load via a synthetic MouseEvent with ctrlKey: true. The attack vector is limited to the iframe content origin: an attacker must control or compromise the content served into that iframe. Electron apps that do not embed untrusted content in sandboxed iframes, or that enforce window denial through setWindowOpenHandler, are not exploitable regardless of version.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects network-reachable, unauthenticated exploitation with a scope change - the iframe sandbox boundary is escaped. In practice, real-world risk is conditional: only Electron applications that (1) embed untrusted or third-party content in sandboxed iframes and (2) rely solely on the iframe sandbox for popup prevention are affected. Applications using setWindowOpenHandler with { action: 'deny' } as a defense-in-depth layer are not exploitable. EPSS data was not provided in the input, so exploitation probability cannot be quantified beyond the CVSS signal. KEV status is not confirmed - no active exploitation has been attributed by CISA. The patch diff includes a functional regression test that doubles as a proof-of-concept, demonstrating the bypass requires only a DOMContentLoaded handler dispatching a synthetic Ctrl+click, with no user gesture required. This elevates practical severity for affected apps beyond what a low EPSS score might suggest. The S:C (scope change) metric is justified because the iframe sandbox boundary - a security primitive - is crossed. Overall: high priority for Electron apps embedding untrusted content, moderate-to-low priority for apps not in that configuration.

A threat actor serves a malicious webpage from an attacker-controlled origin that is embedded as a sandboxed iframe (with allow-scripts but without allow-popups) inside a vulnerable Electron application. On DOMContentLoaded, the iframe's JavaScript constructs an anchor element and dispatches a synthetic MouseEvent with ctrlKey: true, triggering the OpenURL navigation path. Because the affected versions do not check WebSandboxFlags::kPopups in OpenURLFromTab, Electron opens a new BrowserWindow to an attacker-controlled URL - bypassing the sandbox restriction entirely, with no user click required. The resulting window could display a phishing page within the trusted application chrome or attempt to initiate further Electron API interactions.