CVE-2026-102676

[CVE catalog]

Severity

High · CVSS 8.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Published

Sep 29, 2026, 4:56:49 PM UTC

Updated

Sep 29, 2026, 5:17:07 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.48% · Oct 25, 2026

A flaw was found in Electron. This vulnerability allows untrusted guest content loaded inside an embedded web view to run background worker tasks with elevated privileges. By enabling Node.js integration within background web workers, an attacker can bypass security restrictions set by the host application that disable Node.js access. Successful exploitation can lead to privilege escalation and arbitrary code execution within the context of the host application. electron: electron: Privilege escalation via unauthorized Node.js integration in web workers A flaw was found in Electron where an embedded <webview> guest can enable nodeIntegrationInWorker for background Web Workers even when Node.js integration is disabled in the unsandboxed embedder. Untrusted guest content loaded inside a web view can exploit this behavior to spawn a Node-enabled worker, bypassing host security restrictions to achieve privilege escalation and arbitrary code execution within the context of the host application process. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.