A flaw was found in Electron. When a popup window is opened from an embedded web frame (iframe) using navigation actions such as opening a link in a new tab, the popup fails to inherit the frame's sandbox security restrictions. A remote attacker controlling untrusted content within a sandboxed frame can exploit this issue to open a popup under the host application's security origin. This flaw primarily leads to information disclosure and unauthorized scripting, exposing sensitive application data such as cookies and storage.
Last checked: 2026-10-15 16:19 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 19:34 UTC)
Fix evidence last checked: 2026-10-15 15:54 UTC