CVE-2026-114121 electron CVE debrief

Who should care

Developers and maintainers of Electron applications, especially those that grant openExternal based on the requesting origin and let untrusted content open or navigate windows, should assess their exposure and take appropriate measures.

Why it matters

Electron's openExternal permission requests can be misattributed, allowing untrusted content to launch external applications. Developers should verify their app's exposure and take measures to prevent exploitation.

• Untrusted content may launch OS-registered external applications if the app grants openExternal based on the requesting origin.
• Apps that deny openExternal for untrusted content are not affected.
• Verify if your app's permission handler grants openExternal based on the requesting origin.
• Update to a fixed version to prevent potential misattribution.

Technical summary

Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, allowing untrusted content to launch an OS-registered external application if the app grants openExternal based on the requesting origin. This vulnerability affects Electron applications that grant openExternal permissions based on the requesting origin and let untrusted content open or navigate windows. Developers should verify their app's exposure and take measures to prevent exploitation. The vulnerability is caused by a misattribution of openExternal permission requests, which can lead to security risks if not properly addressed.

Defensive priority

Apps using Electron should assess their exposure and verify if their permission handler grants openExternal based on the requesting origin, especially if untrusted content can open or navigate windows.

Recommended defensive actions

• Verify if your app grants openExternal based on the requesting origin and takes appropriate measures.
• Deny the openExternal permission for untrusted content.
• Deny windows opened by untrusted content with setWindowOpenHandler.
• Update to a fixed version: 45.0.0-alpha.5, 44.3.0, 43.7.0, or 42.11.3.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The source corpus provides details on the vulnerability and affected versions. However, the corpus does not provide information on exploitation or specific victims. Based on the provided information, it appears that the vulnerability is related to the openExternal permission requests in Electron. The affected versions of Electron are 43.7.0, 44.3.0, 45.0.0-alpha.5, and 42.11.3. Developers should verify if their app's permission handler grants openExternal based on the requesting origin and take appropriate measures to prevent misattri

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.