{"id":"CVE-2026-113796","kind":"vulnerability","aliases":["CVE-2026-113796","GHSA-2p8c-gr87-2676"],"related":[],"title":"Electron: SameSite cookie restrictions are not applied to windows opened from links","description":"### Impact\n\nPages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: `SameSite=Strict` cookies were sent and `Sec-Fetch-Site` did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence.\n\nApps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with `setWindowOpenHandler` are not affected.\n\n### Workarounds\n\nReturn `{ action: 'deny' }` from `setWindowOpenHandler` for windows opened by untrusted content.\n\n### Fixed Versions\n\n* `45.0.0-alpha.6`\n* `44.3.0`\n* `43.7.0`\n* `42.11.3`\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","summary":"Electron windows opened from links in a page are treated as same-site with the app, so SameSite=Strict cookies get sent on the request. A malicious page in the app can use this to make credentialed top-level requests to other sites that rely on SameSite cookies for CSRF protection.","severity":"medium","cvss":4.2,"epss":0.0018400000408291817,"exploited":false,"exploited_at":null,"products":[{"name":"electron","fixed":["45.0.0-alpha.6"],"affected":">= 45.0.0-alpha.1, < 45.0.0-alpha.6","ecosystem":"npm"},{"name":"electron","fixed":["44.3.0"],"affected":">= 44.0.0-alpha.1, < 44.3.0","ecosystem":"npm"},{"name":"electron","fixed":["43.7.0"],"affected":">= 43.0.0-alpha.1, < 43.7.0","ecosystem":"npm"},{"name":"electron","fixed":["42.11.3"],"affected":"< 42.11.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-352","desktop-apps","electron","package","untrusted-content"],"not_affected_if":["default-config","no-untrusted-content","window-open-denied"],"how_to_check":"Run `npm ls electron` to find the installed Electron version.\nCheck whether the app loads untrusted content and whether its window open handler (setWindowOpenHandler) returns deny for untrusted windows.","fix":"Upgrade to electron 45.0.0-alpha.6, 44.3.0, 43.7.0, or 42.11.3, matching your major line.\nAs a workaround, return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content.","status":"open","published_at":"2026-10-21T17:18:24+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:03:25+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T20:03:25Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to electron 45.0.0-alpha.6, 44.3.0, 43.7.0, or 42.11.3, matching your major line.\nAs a workaround, return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content.","summary":"Electron windows opened from links in a page are treated as same-site with the app, so SameSite=Strict cookies get sent on the request. A malicious page in the app can use this to make credentialed top-level requests to other sites that rely on SameSite cookies for CSRF protection.","category":"package","who_cares":["electron","desktop-apps","untrusted-content"],"confidence":0.85,"analyst_note":"","how_to_check":"Run `npm ls electron` to find the installed Electron version.\nCheck whether the app loads untrusted content and whether its window open handler (setWindowOpenHandler) returns deny for untrusted windows.\nunknown","needs_analyst":false,"not_affected_if":["no-untrusted-content","window-open-denied","default-config"],"severity_if_unknown":"medium"},"cost_usd":0.00043,"input_tokens":2436,"output_tokens":373,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113796':15A,23A '-2026':14A,22A '-352':29B '2676':20A '2p8c':18A '42.11.3':219C '43.7.0':218C '44.3.0':217C '45.0.0':215C 'action':203C 'advisori':232C 'affect':175C,200C 'allow':182C 'alpha.6':216C 'anoth':161C 'app':32B,54B,69B,106C,148C,172C,188C 'appli':7A 'comment':229C 'contain':116C 'content':37B,144C,180C,195C,212C 'cooki':3A,58B,87B,130C,167C 'could':149C 'credenti':75B,155C 'csrf':89B,170C 'cve':13A,21A 'cwe':28B 'defenc':171C 'deni':190C,204C 'desktop':31B 'desktop-app':30B 'electron':1A,24A,25A,26A,27A,33B,38B 'email':233C 'fetch':136C 'fix':213C 'get':59B 'ghsa':17A 'ghsa-2p8c-gr87':16A 'gr87':19A 'identifi':140C 'impact':91C 'inform':222C 'initi':142C 'level':78B,158C 'link':12A,42B,100C,118C 'load':102C,178C 'mailto':237C 'make':74B,153C 'malici':65B 'navig':109C 'new':96C,186C,191C 'open':10A,40B,93C,185C,209C 'packag':34B 'page':45B,66B,92C,114C,143C 'protect':90B 'question':227C 'rather':111C 'reli':84B,164C 'request':63B,79B,121C,159C 'restrict':4A 'return':202C 'same-sit':49B,125C 'samesit':2A,56B,86B,128C,166C 'sec':135C 'sec-fetch-sit':134C 'security@electronjs.org':236C,238C 'sent':60B,132C 'setwindowopenhandl':197C,206C 'shown':145C 'site':51B,82B,127C,137C,162C 'strict':57B,129C 'top':77B,157C 'top-level':76B,156C 'treat':47B,123C 'untrust':36B,179C,194C,211C 'untrusted-cont':35B 'us':234C 'use':71B,150C 'version':214C 'window':9A,39B,97C,187C,192C,208C 'workaround':201C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-2p8c-gr87-2676","url":"https://github.com/advisories/GHSA-2p8c-gr87-2676","severity":"medium","published_at":"2026-10-22T16:47:54+00:00","modified_at":"2026-10-22T16:47:55+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-113796","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113796","severity":null,"published_at":"2026-10-21T17:18:24+00:00","modified_at":"2026-10-23T15:17:24+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}