Live › vulnerability › CVE-2026-114121
Go to dashboardElectron could attribute an external-protocol launch request to a different document than the one that made it, so the requestingUrl seen by a permission handler could be a trusted origin. An attacker-controlled page could then get an OS-registered external application launched if the app grants openExternal based on origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| electron | npm | < 42.11.3 | 42.11.3 |
| electron | npm | >= 43.0.0-alpha.1, < 43.7.0 | 43.7.0 |
| electron | npm | >= 44.0.0-alpha.1, < 44.3.0 | 44.3.0 |
| electron | npm | >= 45.0.0-alpha.1, < 45.0.0-alpha.5 | 45.0.0-alpha.5 |
s session.setPermissionRequestHandler grants the openExternal' permission based on requestingUrl42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5 depending on release lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.
Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies openExternal for untrusted content are not affected.
Deny the openExternal permission for untrusted content, or deny the windows it opens with setWindowOpenHandler.
45.0.0-alpha.544.3.043.7.042.11.3If you have any questions or comments about this advisory, email us at [email protected]
This page as .md · .json · in your agent: get_signal("CVE-2026-114121")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.