CVE-2026-102673

npm/electron CVE-2026-102673: high 8.2, EPSS 0.13%

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Action: Upgrade electron to 41.10.4 or later.

npm i electron@41.10.4

npm i electron@42.5.2

npm i electron@43.0.0

Affected

Fixed versions

Sources

• osv: GHSA-hq2x-r82h-9wj4
• https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4
• https://github.com/electron/electron/pull/52133
• https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba
• https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69
• https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da
• https://github.com/electron/electron
• https://github.com/electron/electron/releases/tag/v41.10.4
• https://github.com/electron/electron/releases/tag/v42.5.2
• https://github.com/electron/electron/releases/tag/v43.0.0

CVE-2026-102673 · published 2026-09-29T18:05:34Z · modified 2026-09-29T18:15:04.710097878Z · JSON