Electron EUVD-2026-89091

Exploitation is limited to Electron applications that render UNTRUSTED content inside a top-level document made sandboxed via a Content-Security-Policy 'sandbox' directive (e.g. 'sandbox allow-scripts allow-popups') where popups are permitted. It additionally requires user interaction (UI:R) to trigger the popup (window.open / target=_blank). Applications are NOT affected if they deny such popups via setWindowOpenHandler, if they do not embed untrusted content, or if they do not use a sandboxing CSP that still allows popups. Fixed in 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, so only earlier versions are vulnerable.

This is a genuine but conditionally-triggered security-boundary bypass, not a high-CVSS-but-low-impact paper cut. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, 8.2 High) reflects a network-reachable, low-complexity, unauthenticated origin-confinement break where the scope changes (S:C) because the escaping content jumps from the intended sandboxed/null origin into the Electron app's full origin. However, exploitability signals point to targeted rather than opportunistic risk: EPSS is not provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC is referenced - status is 'no public exploit identified at time of analysis.' Reported by GitHub_M via the vendor's own GHSA-gr2m-v5gq-v685 advisory with four remediation commits and pinned fixed releases, so the fix is well-confirmed. The real limiter is architectural applicability, not attacker skill: only Electron apps that (a) render untrusted content inside a top-level document made sandboxed by a CSP 'sandbox' header, (b) permit that content to open popups, and (c) do NOT deny popups via setWindowOpenHandler are affected. The CWE is CWE-266 (incorrect privilege assignment); the 'Information Disclosure' tag is a loose fit given C:H is the primary impact but understates the same-origin scripting exposure. This is a direct twin of the sandboxed-iframe variant CVE-2026-102673, differing only in that the sandbox originates from a top-level CSP header (no parent frame) rather than an iframe attribute.

An Electron application loads untrusted web content in a top-level document that is sandboxed via a CSP 'sandbox allow-scripts allow-popups' header. The malicious content opens a popup window (e.g. via window.open/target=_blank); instead of inheriting the sandbox's restricted null origin, the popup is created with the Electron app's full origin, giving the attacker's script access to the app's cookies, localStorage, and same-origin resources. No public exploit code is currently identified, but the vendor test suite demonstrates the exact origin/localStorage/cookie escape.