A flaw was found in Electron. When a popup window is opened from an embedded web frame (iframe) using navigation actions such as opening a link in a new tab, the popup fails to inherit the frame's sandbox security restrictions. A remote attacker controlling untrusted content within a sandboxed frame can exploit this issue to open a popup under the host application's security origin. This flaw primarily leads to information disclosure and unauthorized scripting, exposing sensitive application data such as cookies and storage.
Fix evidence last checked: 2026-10-01 16:37 UTC