{"id":"CVE-2026-114121","kind":"vulnerability","aliases":["CVE-2026-114121","GHSA-997q-gvvc-jwmx"],"related":[],"title":"Electron: openExternal permission requests can be attributed to the wrong origin","description":"### Impact\nRequests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the `requestingUrl` passed to `session.setPermissionRequestHandler` was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.\n\nApps are only affected if they grant `openExternal` based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies `openExternal` for untrusted content are not affected.\n\n### Workarounds\nDeny the `openExternal` permission for untrusted content, or deny the windows it opens with `setWindowOpenHandler`.\n\n### Fixed Versions\n* `45.0.0-alpha.5`\n* `44.3.0`\n* `43.7.0`\n* `42.11.3`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","summary":"Electron could attribute an external-protocol launch request to a different document than the one that made it, so the requestingUrl seen by a permission handler could be a trusted origin. An attacker-controlled page could then get an OS-registered external application launched if the app grants openExternal based on origin.","severity":"medium","cvss":5.400000095367432,"epss":0.0017900000093504786,"exploited":false,"exploited_at":null,"products":[{"name":"electron","fixed":["42.11.3"],"affected":"< 42.11.3","ecosystem":"npm"},{"name":"electron","fixed":["43.7.0"],"affected":">= 43.0.0-alpha.1, < 43.7.0","ecosystem":"npm"},{"name":"electron","fixed":["44.3.0"],"affected":">= 44.0.0-alpha.1, < 44.3.0","ecosystem":"npm"},{"name":"electron","fixed":["45.0.0-alpha.5"],"affected":">= 45.0.0-alpha.1, < 45.0.0-alpha.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-346","desktop-apps","electron","npm","runtime"],"not_affected_if":["no-origin-based-permission-grants","openexternal-denied-for-untrusted","untrusted-content-cannot-open-windows"],"how_to_check":"Check whether the app's session.setPermissionRequestHandler grants the 'openExternal' permission based on requestingUrl.\nCheck the installed electron version in package.json or node_modules/electron/package.json.\nIf the app lets untrusted content open windows, check whether setWindowOpenHandler is used.","fix":"Upgrade electron to 42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5 depending on release line.\nUntil upgraded, deny the openExternal permission for untrusted content or deny windows it opens via setWindowOpenHandler.","status":"open","published_at":"2026-10-21T17:18:25+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T19:58:12+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T19:58:12Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade electron to 42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5 depending on release line.\nUntil upgraded, deny the openExternal permission for untrusted content or deny windows it opens via setWindowOpenHandler.","summary":"Electron could attribute an external-protocol launch request to a different document than the one that made it, so the requestingUrl seen by a permission handler could be a trusted origin. An attacker-controlled page could then get an OS-registered external application launched if the app grants openExternal based on origin.","category":"runtime","who_cares":["electron","desktop-apps","npm"],"confidence":0.85,"analyst_note":"","how_to_check":"Check whether the app's session.setPermissionRequestHandler grants the 'openExternal' permission based on requestingUrl.\nCheck the installed electron version in package.json or node_modules/electron/package.json.\nIf the app lets untrusted content open windows, check whether setWindowOpenHandler is used.","needs_analyst":false,"not_affected_if":["openexternal-denied-for-untrusted","no-origin-based-permission-grants","untrusted-content-cannot-open-windows"],"severity_if_unknown":"medium"},"cost_usd":0.000456,"input_tokens":2422,"output_tokens":428,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114121':14A,22A '-2026':13A,21A '-346':28B '42.11.3':200C '43.7.0':199C '44.3.0':198C '45.0.0':196C '997q':17A 'advisori':213C 'affect':148C,177C 'alpha.5':197C 'app':31B,84B,145C,166C 'applic':80B,144C 'ask':108C 'attack':69B 'attacker-control':68B 'attribut':7A,37B,99C 'base':87B,131C,153C 'comment':210C 'content':125C,137C,161C,174C,185C 'control':70B 'could':36B,62B,72B,97C,133C 'cve':12A,20A 'cwe':27B 'deni':170C,179C,187C 'desktop':30B 'desktop-app':29B 'differ':46B 'document':47B,102C 'electron':1A,23A,24A,25A,26A,32B,35B 'email':214C 'extern':40B,79B,94C,143C 'external-protocol':39B 'fix':194C 'get':74B 'ghsa':16A 'ghsa-997q-gvvc-jwmx':15A 'grant':85B,151C 'gvvc':18A 'handler':61B,132C,169C 'impact':90C 'inform':203C 'jwmx':19A 'launch':42B,81B,123C,138C 'let':135C,159C 'made':52B 'mailto':218C 'navig':164C 'npm':33B 'one':50B,106C 'open':93C,162C,191C 'openextern':2A,86B,152C,171C,181C 'origin':11A,66B,89B,120C,130C,157C 'origin-bas':129C 'os':77B,141C 'os-regist':76B,140C 'page':71B 'pass':114C 'permiss':3A,60B,168C,182C 'protocol':41B,95C 'question':208C 'regist':78B,142C 'request':4A,43B,91C,127C,156C 'requestingurl':56B,113C 'runtim':34B 'security@electronjs.org':217C,219C 'seen':57B 'session.setpermissionrequesthandler':116C 'setwindowopenhandl':193C 'therefor':134C 'trust':65B,119C 'untrust':124C,136C,160C,173C,184C 'url':96C 'us':215C 'version':195C 'whose':167C 'window':165C,189C 'workaround':178C 'wrong':10A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-997q-gvvc-jwmx","url":"https://github.com/advisories/GHSA-997q-gvvc-jwmx","severity":"medium","published_at":"2026-10-22T16:43:59+00:00","modified_at":"2026-10-22T16:44:01+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114121","severity":null,"published_at":"2026-10-21T17:18:25+00:00","modified_at":"2026-10-22T17:29:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}