AIKIDO-2026-656516
electron is vulnerable to Incorrect Privilege Assignment
82
CVE Score
High
Incorrect Privilege Assignment
TL;DR
Windows opened from a sandboxed top-level document do not inherit that document's HTML sandbox restrictions, so content meant to run sandboxed can open a window carrying the app's full origin. This affects apps that render untrusted content in a sandboxed top-level document that allows popups and do not deny them in setWindowOpenHandler. The fix propagates the top-level document's sandbox flags to windows it opens, mirroring the existing fix for sandboxed iframes.
How do I fix this?
Upgrade the electron library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you render untrusted content in a sandboxed top-level document that allows popups.
Package
Versions
1.0.0 - 41.10.5
Fixed in 41.10.642.0.0 - 42.9.1
Fixed in 42.9.243.0.0 - 43.4.0
Fixed in 43.4.1Background info
electron is vulnerable to Incorrect Privilege Assignment in versions 1.0.0 - 41.10.5, 42.0.0 - 42.9.1 and 43.0.0 - 43.4.0.
Links
GitHub Releases
github.com/electron/electron/releases/tag/v42.9.2github.com/electron/electron/releases/tag/v41.10.6github.com/electron/electron/releases/tag/v43.4.1github.com/electron/electron/releases/tag/v44.0.0-beta.5Fix Commits
github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1dgithub.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.