CVE-2026-102673

[CVE catalog]

Severity

High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Published

Sep 29, 2026, 4:38:41 PM UTC

Updated

Sep 29, 2026, 5:17:07 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.13% · Oct 25, 2026

A flaw was found in Electron. When a popup window is opened from an embedded web frame (iframe) using navigation actions such as opening a link in a new tab, the popup fails to inherit the frame's sandbox security restrictions. A remote attacker controlling untrusted content within a sandboxed frame can exploit this issue to open a popup under the host application's security origin. This flaw primarily leads to information disclosure and unauthorized scripting, exposing sensitive application data such as cookies and storage. electron: Electron: Sandbox bypass via popups opened from sandboxed iframes A flaw was found in Electron where popup windows opened from a sandboxed iframe via navigation actions (such as target="_blank" links or middle-clicks) fail to inherit the iframe's sandbox security restrictions. An attacker controlling untrusted content in a sandboxed iframe configured with allow-scripts and allow-popups can exploit this issue to open a popup running under the embedding application's full origin, exposing sensitive data such as cookies, storage, and same-origin scripting capabilities. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.