CVE-2026-114121
Electron: openExternal permission requests can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Electron: openExternal permission requests can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
- Record
CVE-2026-114121- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
EUVDEUVD-2026-107361
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
- Record
EUVD-2026-107361- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-997q-gvvc-jwmx
Electron: openExternal permission requests can be attributed to the wrong origin
Impact
Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.
Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies openExternal for untrusted content are not affected.
Workarounds
Deny the openExternal permission for untrusted content, or deny the windows it opens with setWindowOpenHandler.
Fixed Versions
45.0.0-alpha.544.3.043.7.042.11.3
For more information
If you have any questions or comments about this advisory, email us at [email protected]
- Record
GHSA-997q-gvvc-jwmx- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
- Record
CVE-2026-114121- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSV
Electron: openExternal permission requests can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
- Record
CVE-2026-114121- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSVGHSA-997q-gvvc-jwmx
Electron: openExternal permission requests can be attributed to the wrong origin
Impact
Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.
Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies openExternal for untrusted content are not affected.
Workarounds
Deny the openExternal permission for untrusted content, or deny the windows it opens with setWindowOpenHandler.
Fixed Versions
45.0.0-alpha.544.3.043.7.042.11.3
For more information
If you have any questions or comments about this advisory, email us at [email protected]
- Record
GHSA-997q-gvvc-jwmx- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-114121 is a medium vulnerability (CVSS 5.4) in Electron, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in electron 42.11.3.
References
github.com/electron/electron/security/advisories/GHSA-997q-gvvc-jwmx
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-114121