SECUFOCUSNOW
Home›CVE index›CVE-2026-34765
Review reviewHigh

CVE-2026-34765

electron

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by th...

CVSS
8.8
EPSS
0.30%
22.2% percentile
CISA KEV
Not listed
Published
2026.04.08
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.30%
Technical severityCVSS 8.8

Vulnerability overview

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by th...

Affected product and versions

Product
electron
Affected versions
>= < 39.8.5, >= >= 40.0.0-alpha.1, < 40.8.5, >= >= 41.0.0-alpha.1, < 41.1.0, >= >= 42.0.0-alpha.1, < 42.0.0-alpha.5, <= 39.8.4, >= 40.0.0 <= 40.8.4, >= 41.0.0 < 41.1.0, 41.2.0, 42.0.0
Fixed versions
41.1.0

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that electron and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-668