CVE-2026-113796 electron CVE debrief

Who should care

Defenders responsible for Electron applications that load untrusted content and allow it to open new windows should assess exposure and prioritize remediation. This includes developers and security teams working with Electron applications in various deployment contexts.

Why it matters

Electron applications loading untrusted content and allowing new windows are vulnerable to SameSite cookie bypass, enabling potential credentialed requests. Defenders should verify exposure, prioritize remediation, and consider compensating controls.

• Credentialed top-level requests to another site could be made, potentially bypassing CSRF defenses.
• Defenders need to verify exposure in Electron applications and assess the use of setWindowOpenHandler.
• Remediation involves updating to fixed versions or implementing compensating controls like restricting untrusted content.

Technical summary

The Electron application framework has a vulnerability where SameSite cookie restrictions are not applied to windows opened from links. This allows content shown in the app to make credentialed top-level requests to another site that relies on SameSite cookies as a CSRF defense. The issue arises because pages opened into a new window from a link are loaded as if the app itself had navigated there, rather than the page containing the link. This treats the request as same-site, sending `SameSite=Strict` cookies and not identifying the initiating page via `Sec-Fetch-Site`. Apps are only affected if they load untrusted content and allow it to open new windows. The vulnerability can be mitigated by updating to fixed

Defensive priority

Defenders should prioritize verifying exposure in Electron applications that load untrusted content and allow new windows, assessing the use of setWindowOpenHandler.

Recommended defensive actions

• Verify Electron application versions and update to fixed versions (44.3.0, 43.7.0, 42.11.3, or 45.0.0-alpha.6) if vulnerable.
• Assess and restrict untrusted content loading and new window opening in Electron applications.
• Implement setWindowOpenHandler to deny new windows from untrusted content.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The source corpus provides details on the vulnerability, its impact, and fixed versions (44.3.0, 43.7.0, 42.11.3, 45.0.0-alpha.6). However, it does not provide information on exploitation or affected versions beyond the given ranges. Defenders should verify Electron application versions and assess the use of `setWindowOpenHandler`. The source item from osv_dev provides a brief description of the vulnerability. Official CVE and NVD records offer additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.