CVE-2026-102674

[CVE catalog]

Severity

High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Published

Sep 29, 2026, 4:51:26 PM UTC

Updated

Sep 29, 2026, 5:17:07 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.24% · Oct 25, 2026

A flaw was found in Electron. Windows opened from a sandboxed top-level document do not inherit that document's active sandbox restrictions. An attacker capable of delivering untrusted content to a sandboxed document can open a popup window that runs with the application's full origin rather than the restricted origin. This can lead to a sandbox bypass, allowing unauthorized access to sensitive application data or internal resources. electron: Electron: Sandbox bypass via popup window creation A flaw was found in Electron where child windows opened from a sandboxed top-level document fail to inherit the document's active HTML sandbox restrictions. An attacker capable of delivering untrusted content to a sandboxed document that is permitted to open popups can spawn a window running under the application's full origin. This leads to a sandbox bypass, enabling unauthorized access to sensitive application data or internal resources. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.