https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 22:46:11 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113796 <p>Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application that loads untrusted content and permits it to open new windows could therefore allow that content to make a credentialed request to another site that relies on SameSite cookies for CSRF protection. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6.</p> <p>Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application that loads untrusted content and permits it to open new windows could therefore allow that content to make a credentialed request to another site that relies on SameSite cookies for CSRF protection. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113796 https://db.gcve.eu/vuln/ghsa-2p8c-gr87-2676 <p><strong>Affected:</strong> npm: electron</p> <p>### Impact</p> <p>Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: `SameSite=Strict` cookies were sent and `Sec-Fetch-Site` did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence.</p> <p>Apps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with `setWindowOpenHandler` are not affected.</p> <p>### Workarounds</p> <p>Return `{ action: &#39;deny&#39; }` from `setWindowOpenHandler` for windows opened by untrusted content.</p> <p>### Fixed Versions</p> <p>* `45.0.0-alpha.6` * `44.3.0` * `43.7.0` * `42.11.3`</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)</p> <p><strong>Affected:</strong> npm: electron</p> <p>### Impact</p> <p>Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: `SameSite=Strict` cookies were sent and `Sec-Fetch-Site` did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence.</p> <p>Apps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with `setWindowOpenHandler` are not affected.</p> <p>### Workarounds</p> <p>Return `{ action: &#39;deny&#39; }` from `setWindowOpenHandler` for windows opened by untrusted content.</p> <p>### Fixed Versions</p> <p>* `45.0.0-alpha.6` * `44.3.0` * `43.7.0` * `42.11.3`</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)</p> https://db.gcve.eu/vuln/ghsa-2p8c-gr87-2676