GHSA-V93F-FGJR-HJRJ

Vulnerability from github – Published: 2026-08-05 16:24 – Updated: 2026-08-05 16:24
VLAI
Summary
Electron: window.open features string controls some window options considered privileged
Details

Impact

Some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths.

Apps are only affected if untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler. Apps that deny window.open() for untrusted content, or set overrideBrowserWindowOptions explicitly, are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for untrusted content, or supply overrideBrowserWindowOptions so every window option is set explicitly.

Fixed Versions

  • 42.0.0-beta.3
  • 41.2.1
  • 40.9.0
  • 39.8.8

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "39.8.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "40.0.0-alpha.1"
            },
            {
              "fixed": "40.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "41.0.0-alpha.1"
            },
            {
              "fixed": "41.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "42.0.0-alpha.1"
            },
            {
              "fixed": "42.0.0-beta.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-70607"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-05T16:24:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nSome window options supplied by web content in the `window.open()` features string were applied to the new `BrowserWindow` without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths.\n\nApps are only affected if untrusted content can call `window.open()` and the app does not override child window options via `setWindowOpenHandler`. Apps that deny `window.open()` for untrusted content, or set `overrideBrowserWindowOptions` explicitly, are not affected.\n\n### Workarounds\nReturn `{ action: \u0027deny\u0027 }` from `setWindowOpenHandler` for untrusted content, or supply `overrideBrowserWindowOptions` so every window option is set explicitly.\n\n### Fixed Versions\n* `42.0.0-beta.3`\n* `41.2.1`\n* `40.9.0`\n* `39.8.8`\n\n### For more information\nIf you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org)",
  "id": "GHSA-v93f-fgjr-hjrj",
  "modified": "2026-08-05T16:24:17Z",
  "published": "2026-08-05T16:24:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/50946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/50947"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/50948"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/pull/50949"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/4eff3dc09e4d1e62d649c5ce9902f532bb7469c7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/615d62500fc7732d068274b796c49487e652e90b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/commit/fe2e7d0073949b4593b624b93abf1788f5377e55"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electron/electron"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/releases/tag/v39.8.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/releases/tag/v40.9.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/releases/tag/v41.2.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/releases/tag/v42.0.0-beta.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Electron: window.open features string controls some window options considered privileged"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.