NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

NPM: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...

PT-2026-68284

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.10 Electron versions prior to 41.10.3 Electron versions prior to 42.0.1 Description A sandboxed iframe lacking the allow-popups keyword can open a new window or trigger the setWindowOpenHandler function without...