CVE-2026-34765 (GCVE-0-2026-34765)

Vulnerability from cvelistv5 – Published: 2026-04-07 21:18 – Updated: 2026-04-13 15:37
VLAI
Title
Electron named window.open targets not scoped to the opener's browsing context
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.
Severity
6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-668 - Exposure of Resource to Wrong Sphere
Assigner
References
Impacted products
Vendor Product Version
electron electron Affected: < 39.8.5
Affected: >= 40.0.0-alpha.1, < 40.8.5
Affected: >= 41.0.0-alpha.1, < 41.1.0
Affected: >= 42.0.0-alpha.1, < 42.0.0-alpha.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T03:56:10.527333Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T15:37:12.686Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 39.8.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 40.0.0-alpha.1, \u003c 40.8.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 41.0.0-alpha.1, \u003c 41.1.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 42.0.0-alpha.1, \u003c 42.0.0-alpha.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener\u0027s browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler\u0027s overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "CWE-668: Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-07T21:18:35.375Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8"
        }
      ],
      "source": {
        "advisory": "GHSA-f3pv-wv63-48x8",
        "discovery": "UNKNOWN"
      },
      "title": "Electron named window.open targets not scoped to the opener\u0027s browsing context"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34765",
    "datePublished": "2026-04-07T21:18:35.375Z",
    "dateReserved": "2026-03-30T19:54:55.554Z",
    "dateUpdated": "2026-04-13T15:37:12.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34765",
      "date": "2026-07-24",
      "epss": "0.003",
      "percentile": "0.22117"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34765\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-07T22:16:22.960\",\"lastModified\":\"2026-07-24T22:10:00.140\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener\u0027s browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler\u0027s overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.\"},{\"lang\":\"es\",\"value\":\"Electron es un framework para escribir aplicaciones de escritorio multiplataforma usando JavaScript, HTML y CSS. Antes de 39.8.5, 40.8.5, 41.1.0 y 42.0.0-alpha.5, cuando un renderizador llama a window.open() con un nombre de destino, Electron no delimitaba correctamente la b\u00fasqueda de la ventana con nombre al grupo de contexto de navegaci\u00f3n del abridor. Un renderizador pod\u00eda navegar una ventana secundaria existente que fue abierta por un renderizador diferente y no relacionado si ambos usaban el mismo nombre de destino. Si esa ventana secundaria existente fue creada con webPreferences m\u00e1s permisivas (a trav\u00e9s de overrideBrowserWindowOptions de setWindowOpenHandler), el contenido cargado por el segundo renderizador hereda esos permisos. Las aplicaciones solo se ven afectadas si abren m\u00faltiples ventanas de nivel superior con diferentes niveles de confianza y usan setWindowOpenHandler para otorgar a las ventanas secundarias webPreferences elevadas, como un script de precarga privilegiado. Las aplicaciones que no elevan los privilegios de las ventanas secundarias, o que usan una \u00fanica ventana de nivel superior, no se ven afectadas. Las aplicaciones que adem\u00e1s otorgan nodeIntegration: true o sandbox: false a las ventanas secundarias (contrario a las recomendaciones de seguridad) pueden estar expuestas a ejecuci\u00f3n de c\u00f3digo arbitrario. Esta vulnerabilidad est\u00e1 corregida en 39.8.5, 40.8.5, 41.1.0 y 42.0.0-alpha.5.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"electron\",\"product\":\"electron\",\"versions\":[{\"version\":\"\u003c 39.8.5\",\"status\":\"affected\"},{\"version\":\"\u003e= 40.0.0-alpha.1, \u003c 40.8.5\",\"status\":\"affected\"},{\"version\":\"\u003e= 41.0.0-alpha.1, \u003c 41.1.0\",\"status\":\"affected\"},{\"version\":\"\u003e= 42.0.0-alpha.1, \u003c 42.0.0-alpha.5\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":6.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":3.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-09T03:56:10.527333Z\",\"id\":\"CVE-2026-34765\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*\",\"versionEndIncluding\":\"39.8.4\",\"matchCriteriaId\":\"239C939D-31F6-414C-AF8A-385ADA0F2A17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"40.0.0\",\"versionEndIncluding\":\"40.8.4\",\"matchCriteriaId\":\"8190FCCE-AFCA-4D8C-BF8B-C8A3996B0D9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"41.0.0\",\"versionEndExcluding\":\"41.1.0\",\"matchCriteriaId\":\"A87A2631-72BF-432E-B014-AEFE45CB9BAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:41.2.0:*:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"AE2BDFE9-435B-4E7A-9785-0805EE1AED4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:42.0.0:alpha1:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"498062D8-5C83-4FC2-A04B-94F3228B2BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:42.0.0:alpha2:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"A272F9F4-AB62-407C-B1A8-18586A474C19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:42.0.0:alpha3:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"BF49E260-9653-4D26-8B6C-C6FAFE697F5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:42.0.0:alpha4:*:*:*:node.js:*:*\",\"matchCriteriaId\":\"2F3B609A-0CA5-4E8C-865E-CF79B6B0CCCC\"}]}]}],\"references\":[{\"url\":\"https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T11:42:51+00:00",
      "cve": "CVE-2026-34765",
      "id": "CVE-2026-34765",
      "initial_release_date": "2026-04-07T21:18:35.375000+00:00",
      "product_status:known_affected": "6",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "electron: Electron: Arbitrary code execution or information disclosure via incorrect window handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34765.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34765\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-09T03:56:10.527333Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-08T14:30:52.559Z\"}}], \"cna\": {\"title\": \"Electron named window.open targets not scoped to the opener\u0027s browsing context\", \"source\": {\"advisory\": \"GHSA-f3pv-wv63-48x8\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"electron\", \"product\": \"electron\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 39.8.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 40.0.0-alpha.1, \u003c 40.8.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 41.0.0-alpha.1, \u003c 41.1.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 42.0.0-alpha.1, \u003c 42.0.0-alpha.5\"}]}], \"references\": [{\"url\": \"https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8\", \"name\": \"https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener\u0027s browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler\u0027s overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-668\", \"description\": \"CWE-668: Exposure of Resource to Wrong Sphere\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-07T21:18:35.375Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34765\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-13T15:37:12.686Z\", \"dateReserved\": \"2026-03-30T19:54:55.554Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-07T21:18:35.375Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.