---
id: "CVE-2026-114121"
kind: "vulnerability"
aliases: ["CVE-2026-114121", "GHSA-997q-gvvc-jwmx"]
title: "Electron: openExternal permission requests can be attributed to the wrong origin"
severity: "medium"
cvss: 5.400000095367432
epss: 0.0017900000093504786
exploited: false
status: "open"
category: "runtime"
products: [{"name": "electron", "fixed": ["42.11.3"], "affected": "< 42.11.3", "ecosystem": "npm"}, {"name": "electron", "fixed": ["43.7.0"], "affected": ">= 43.0.0-alpha.1, < 43.7.0", "ecosystem": "npm"}, {"name": "electron", "fixed": ["44.3.0"], "affected": ">= 44.0.0-alpha.1, < 44.3.0", "ecosystem": "npm"}, {"name": "electron", "fixed": ["45.0.0-alpha.5"], "affected": ">= 45.0.0-alpha.1, < 45.0.0-alpha.5", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-346", "desktop-apps", "electron", "npm", "runtime"]
not_affected_if: ["no-origin-based-permission-grants", "openexternal-denied-for-untrusted", "untrusted-content-cannot-open-windows"]
published_at: "2026-10-21T17:18:25+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T21:57:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-997q-gvvc-jwmx", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114121", "first_seen_at": "2026-10-23T21:57:29+00:00"}]
---

# Electron: openExternal permission requests can be attributed to the wrong origin

Electron could attribute an external-protocol launch request to a different document than the one that made it, so the requestingUrl seen by a permission handler could be a trusted origin. An attacker-controlled page could then get an OS-registered external application launched if the app grants openExternal based on origin.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:electron affected < 42.11.3 fixed 42.11.3
- npm:electron affected >= 43.0.0-alpha.1, < 43.7.0 fixed 43.7.0
- npm:electron affected >= 44.0.0-alpha.1, < 44.3.0 fixed 44.3.0
- npm:electron affected >= 45.0.0-alpha.1, < 45.0.0-alpha.5 fixed 45.0.0-alpha.5

## How to check

Check whether the app's session.setPermissionRequestHandler grants the 'openExternal' permission based on requestingUrl.
Check the installed electron version in package.json or node_modules/electron/package.json.
If the app lets untrusted content open windows, check whether setWindowOpenHandler is used.

## Fix

Upgrade electron to 42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5 depending on release line.
Until upgraded, deny the openExternal permission for untrusted content or deny windows it opens via setWindowOpenHandler.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-997q-gvvc-jwmx
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114121

## From the sources

### Impact
Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the `requestingUrl` passed to `session.setPermissionRequestHandler` was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.

Apps are only affected if they grant `openExternal` based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies `openExternal` for untrusted content are not affected.

### Workarounds
Deny the `openExternal` permission for untrusted content, or deny the windows it opens with `setWindowOpenHandler`.

### Fixed Versions
* `45.0.0-alpha.5`
* `44.3.0`
* `43.7.0`
* `42.11.3`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_