Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-266",
"CWE-693"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102674.json"
}{
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "41.10.6"
},
{
"introduced": "42.0.0-alpha.1"
},
{
"fixed": "42.9.2"
},
{
"introduced": "43.0.0-alpha.1"
},
{
"fixed": "43.4.1"
},
{
"introduced": "44.0.0-alpha.1"
},
{
"fixed": "44.0.0-beta.5"
}
],
"source": "AFFECTED_FIELD"
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102674.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"132166606046758158051526596493505750768",
"104473389042782648575626887935579871403",
"47114654854250169262453746570214571218",
"182912991182130868302716466313864386637",
"61165383661454145728045323449984608421",
"299400271465323102701127586518731809186",
"245456773913886588060261575941663783339",
"250483460298542798227738970679205755935",
"291035668283502080031238925799267731023",
"234659984056545043753430124575849176268",
"105315512711035862090042219324713520064"
],
"threshold": 0.9
},
"id": "CVE-2026-102674-0d8b5010",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2",
"target": {
"file": "shell/browser/net/electron_url_loader_factory.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "247133206497420834461812135136988835583",
"length": 278
},
"id": "CVE-2026-102674-34513b41",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/832e70a551348f2b6b2e004b4f09b9eb6ca038c0",
"target": {
"file": "shell/common/platform_util_win.cc",
"function": "ShowItemInFolder"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"189689128200992342418361367641649474730",
"337729662950350085436237188319931410590",
"63819241787708291218508728794525614379",
"152174805680289688897726003869620323275"
],
"threshold": 0.9
},
"id": "CVE-2026-102674-58f6ea82",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/eaabc1dd8108035ea3c125b83b18403a0842d28d",
"target": {
"file": "shell/common/node_bindings.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "246719478950387332579202327323731752726",
"length": 312
},
"id": "CVE-2026-102674-6045f28e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/832e70a551348f2b6b2e004b4f09b9eb6ca038c0",
"target": {
"file": "shell/common/platform_util_win.cc",
"function": "OpenExternal"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "260027154761965378477165897384788904249",
"length": 348
},
"id": "CVE-2026-102674-75a25053",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/832e70a551348f2b6b2e004b4f09b9eb6ca038c0",
"target": {
"file": "shell/common/platform_util_win.cc",
"function": "OpenPath"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"160150358168442405134413423148867883122",
"249972661867234927746201005338793659560",
"333430092313159275848180905940562366050",
"58972548948214865261978042342803642747",
"332692934226393727201234970660254021993",
"124903660434217828995198702263064256623",
"107771910093160600335383340117573360177",
"87312116992820211739792919173691646704",
"50742490742767308278369127406462920469",
"62059404098391321050627587771181480133",
"14118735808520907645547918867884289656",
"26887641258339174933401925422875790081",
"106534308835163143961707415110996362238",
"75657153709267294444380313767272817320",
"314546130724876851095033930053131594031",
"99972824447185400987759306680653538052",
"193436641144557867928187963364345375535",
"129531856487246233013796982588192875424",
"319545875615185909623552860024780997828",
"316552547852563999944316783160049910594",
"157061218699851221909273295762741920428",
"12557955660010540674541408058498756827",
"29102341969558988977470182501126481677",
"158214431232016999276387069364963772191",
"298473393807824863314888324969778453876",
"73910519213966501200847168380422569167",
"84404029866790565151054396422772178930",
"311030754145504307933874078997336166257",
"30254416361026207000275458602638416849",
"314783094964700924630132084933412625444",
"51259686018724779034380570932004382376",
"117946296502122942533445913901597544365"
],
"threshold": 0.9
},
"id": "CVE-2026-102674-a750986b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/832e70a551348f2b6b2e004b4f09b9eb6ca038c0",
"target": {
"file": "shell/common/platform_util_win.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"56766099744177307872908158339506650483",
"169756416271729710341017332534341617392",
"137329918277107552104771563772495804900",
"272821904907890792303238503406729882486",
"325047127065899061943918278783179411226",
"205658525867655140182704803207402754190",
"274959176381820145547154136206107870483",
"258000785513108864232592025711223484155",
"328047313114464995707972839480540432849",
"285388226341968089481977887496152501250",
"110837954124335474942574693351547399044",
"185409841502475421640892510829801049780",
"302477893095335586986735358153279009934",
"300710891698348460585514901362122601506",
"325020869016932585080065153259443165476",
"140985805530043734487165400778239093385",
"305766841965548982442337624657793685704",
"8988115454848443477919818542327035295",
"182204327239125793749852541871750560677",
"202162515333744567690606087597504419837",
"36279977358949177372799639596900012178",
"265800433906488435443771047295127258899",
"240843155438771678674709151425220900830",
"196092611492204652619275397491395686140",
"139860038057963559374832387892157178944",
"261228993596202121015978163830874467189",
"16929371113932813586356757921048108622",
"10969704480492598776597753617394563290",
"73038170653242543021522990199252365886",
"3929232840180688274566716178934777446",
"53742440578062536911017762542640202614",
"198316699460354626077409194298360703232",
"93734836462025666257129948421485234811",
"236785810123935836724548330770896343939",
"292588964166206981440695978788192638450",
"6571571997669212458500655408186682660",
"139860038057963559374832387892157178944",
"33272482282570234647602964863843560617",
"178322765422220739327766027179760372925",
"27820153281648229067457302611533926913",
"244055877962749054325249877581919004974",
"232846308729400971637640217891344426206",
"122872516382940237551769785828923898409",
"197177748484893332822899060336762105307",
"145338800993743128309147638255723796475",
"156500851067837053607926433482289594836",
"200871388141433144458988472737333602467",
"93749243805389795503192864233268405817",
"14943633418586599034792444254447653984"
],
"threshold": 0.9
},
"id": "CVE-2026-102674-b3930db7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2",
"target": {
"file": "shell/browser/net/electron_url_loader_factory.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "235734756777369051289196345664210821287",
"length": 573
},
"id": "CVE-2026-102674-fd95d62e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/eaabc1dd8108035ea3c125b83b18403a0842d28d",
"target": {
"file": "shell/common/node_bindings.cc",
"function": "NodeBindings::UvRunOnce"
}
}
]
"2026-09-30T08:04:59Z"