A flaw was found in Electron. Windows opened from a sandboxed top-level document do not inherit that document's active sandbox restrictions. An attacker capable of delivering untrusted content to a sandboxed document can open a popup window that runs with the application's full origin rather than the restricted origin. This can lead to a sandbox bypass, allowing unauthorized access to sensitive application data or internal resources.
Last checked: 2026-10-15 16:19 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 17:20 UTC)
Fix evidence last checked: 2026-10-16 03:15 UTC