NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab vulnerability discovered by ? in WordPress Npm electron versions 41.10.4...

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Impact Popups opened from a sandboxed iframe through a link for example target="blank" or a middle-click did not inherit the iframe's HTML sandbox restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining access to that origin's cookies...

CVE-2026-102673

The Electron framework (prior to versions 41.10.4 , 42.5.2 , and 43.0.0 ) contains a vulnerability where popups opened via the OpenURLFromTab navigation path do not inherit HTML sandbox restrictions from the parent sandboxed iframe. This occurs when using target="_blank" or a middle-click. An unt...

SUSE CVE-2026-19174

Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-13899

Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-8549

Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...