A flaw was found in Electron. Windows opened from a sandboxed top-level document do not inherit that document's active sandbox restrictions. An attacker capable of delivering untrusted content to a sandboxed document can open a popup window that runs with the application's full origin rather than the restricted origin. This can lead to a sandbox bypass, allowing unauthorized access to sensitive application data or internal resources.
Fix evidence last checked: 2026-10-01 16:37 UTC