CVE-2026-70612

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70608

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

Incorrect Permission Assignment for Critical Resource

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the openExternal. An attacker can cause an OS-registered external...

NPM: Electron: Sandboxed iframes can launch external protocol handlers

NPM: Electron: Sandboxed iframes can launch external protocol handlers vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

Electron: Sandboxed iframes can launch external protocol handlers

Impact Requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame's sandbox state was also not made available to the app's permission handlers. Ap...

GHSA-P2RR-RVMM-C5FP Electron: Sandboxed iframes can launch external protocol handlers

Impact Requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could cause an OS-registered external application to be launched. The frame's sandbox state was also not made available to the app's permission handlers. Ap...

CVE-2026-70612

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

EUVD-2026-53546

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70612 Electron: Sandboxed iframes can launch external protocol handlers

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70612

The vulnerability CVE-2026-70612 affects Electron. It occurs when web content in sandboxed iframes can trigger external protocol handlers, because iframe sandbox restrictions were not applied to openExternal requests and the frame state wasn’t exposed to permission handlers. This could allow an O...

GHSA-9F4C-93C8-JC8G Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Impact A sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in...

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Impact A sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that embed untrusted content in...

CVE-2026-70608

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the getImageForOcclusion function. An attacker can access arbitrary files readable by the application process and exfiltrate their contents over the network by embedding malicious scripts in iframes within import...

GHSA-H5JC-78HR-3PC9 Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

Impact A stored cross-site scripting XSS vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS. The DOMPurify sanitization configuration used for Markdown previews explicitly permitted iframe elements without enforcing a sandbox attribute or restricting iframe sources...

CVE-2026-47901

Logseq is vulnerable to a sandbox escape flaw where plugins running in sandboxed iframes can inject arbitrary HTML attributes, such as event handlers, into their container element in the host DOM. Due to a disabled Content Security Policy CSP, this allows a malicious plugin to execute arbitrary...

CVE-2026-44698

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and...