CVE-2026-102676

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102676", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T16:10:04.075Z", "datePublished": "2026-09-29T16:56:49.007Z", "dateUpdated": "2026-09-29T19:50:28.382Z"}, "containers": {"cna": {"title": "Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1188", "lang": "en", "description": "CWE-1188: Insecure Default Initialization of Resource", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w"}, {"name": "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2"}, {"name": "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671"}, {"name": "https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886"}, {"name": "https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae"}, {"name": "https://github.com/electron/electron/releases/tag/v41.10.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v41.10.6"}, {"name": "https://github.com/electron/electron/releases/tag/v42.9.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v42.9.2"}, {"name": "https://github.com/electron/electron/releases/tag/v43.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v43.4.1"}, {"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"}], "affected": [{"vendor": "electron", "product": "electron", "versions": [{"version": "< 41.10.6", "status": "affected"}, {"version": ">= 42.0.0-alpha.1, < 42.9.2", "status": "affected"}, {"version": ">= 43.0.0-alpha.1, < 43.4.1", "status": "affected"}, {"version": ">= 44.0.0-alpha.1, < 44.0.0-beta.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T16:56:49.007Z"}, "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."}], "source": {"advisory": "GHSA-9qh4-3jw8-366w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T19:50:13.282220Z", "id": "CVE-2026-102676", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T19:50:28.382Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102676", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-29T19:50:13.282220Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T19:50:21.211Z"}}], "cna": {"title": "Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions", "source": {"advisory": "GHSA-9qh4-3jw8-366w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "electron", "product": "electron", "versions": [{"status": "affected", "version": "< 41.10.6"}, {"status": "affected", "version": ">= 42.0.0-alpha.1, < 42.9.2"}, {"status": "affected", "version": ">= 43.0.0-alpha.1, < 43.4.1"}, {"status": "affected", "version": ">= 44.0.0-alpha.1, < 44.0.0-beta.5"}]}], "references": [{"url": "https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w", "name": "https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2", "name": "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671", "name": "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886", "name": "https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae", "name": "https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v41.10.6", "name": "https://github.com/electron/electron/releases/tag/v41.10.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v42.9.2", "name": "https://github.com/electron/electron/releases/tag/v42.9.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v43.4.1", "name": "https://github.com/electron/electron/releases/tag/v43.4.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5", "name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188: Insecure Default Initialization of Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T16:56:49.007Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102676", "state": "PUBLISHED", "dateUpdated": "2026-09-29T19:50:28.382Z", "dateReserved": "2026-09-29T16:10:04.075Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-29T16:56:49.007Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "electron", "vendor": "electron", "versions": [{"status": "affected", "version": "< 41.10.6"}, {"status": "affected", "version": ">= 42.0.0-alpha.1, < 42.9.2"}, {"status": "affected", "version": ">= 43.0.0-alpha.1, < 43.4.1"}, {"status": "affected", "version": ">= 44.0.0-alpha.1, < 44.0.0-beta.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "B4FB09FD-C08F-43AC-8CEC-1A0677E7AF43", "versionEndExcluding": "41.10.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F06ED6A9-4328-4DA8-992F-EEFA235B40CD", "versionEndExcluding": "42.9.2", "versionStartIncluding": "42.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "57780223-7E96-4EE7-88EA-AC7A44AFE435", "versionEndExcluding": "43.4.1", "versionStartIncluding": "43.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "94D88EA0-06B8-4682-B01F-D3E1D7F6F806", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "796732E1-53E5-4D7F-AA0C-9CBDD29F7210", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "522046B0-9E6A-481A-A8B2-69AD79D61259", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "7073A25C-D7C8-42C6-9A19-AF45BE0CDF9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "FD3928C5-4200-4CA6-864C-2537CFCF1039", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "F2E8594F-E690-47D9-BFB9-22E127F4EEC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "3106D6D5-37B3-4422-AB92-95E81B8B18F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "990B95FF-4B70-4E2A-9ADE-96DB4FD83F58", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "550B3853-4CD1-491C-9C66-E3DBDEF5415F", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:beta1:*:*:*:node.js:*:*", "matchCriteriaId": "F3DCC540-D8FC-4602-8150-4F5FA7E6AE8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:beta2:*:*:*:node.js:*:*", "matchCriteriaId": "A6DBFDE8-90FE-47A1-9311-CDADB8598818", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:beta3:*:*:*:node.js:*:*", "matchCriteriaId": "42385506-40E0-4520-86B8-7EA679DD68F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:beta4:*:*:*:node.js:*:*", "matchCriteriaId": "2061B84C-AC6C-4F81-B14B-EA747246A048", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."}], "id": "CVE-2026-102676", "lastModified": "2026-10-15T13:47:42.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102676", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T19:50:13.282220Z", "version": "2.0.3"}}]}, "published": "2026-09-29T17:17:07.973", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v41.10.6"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v42.9.2"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v43.4.1"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-1188"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "electron: electron: Privilege escalation via unauthorized Node.js integration in web workers", "id": "2543319", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543319"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-266", "details": ["Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.", "A flaw was found in Electron. This vulnerability allows untrusted guest content loaded inside an embedded web view to run background worker tasks with elevated privileges. By enabling Node.js integration within background web workers, an attacker can bypass security restrictions set by the host application that disable Node.js access. Successful exploitation can lead to privilege escalation and arbitrary code execution within the context of the host application."], "mitigation": {"lang": "en:us", "value": "Disable the <webview> tag in application configurations or ensure the host embedder process remains strictly sandboxed."}, "name": "CVE-2026-102676", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Affected", "package_name": "rh-podman-desktop", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "podman-desktop", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rh-podman-desktop", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-09-29T16:56:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102676\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102676\nhttps://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2\nhttps://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671\nhttps://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886\nhttps://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae\nhttps://github.com/electron/electron/releases/tag/v41.10.6\nhttps://github.com/electron/electron/releases/tag/v42.9.2\nhttps://github.com/electron/electron/releases/tag/v43.4.1\nhttps://github.com/electron/electron/releases/tag/v44.0.0-beta.5\nhttps://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w"], "statement": "A flaw was found in Electron where an embedded <webview> guest can enable nodeIntegrationInWorker for background Web Workers even when Node.js integration is disabled in the unsandboxed embedder. Untrusted guest content loaded inside a web view can exploit this behavior to spawn a Node-enabled worker, bypassing host security restrictions to achieve privilege escalation and arbitrary code execution within the context of the host application process.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,41.10.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[42.0.0-alpha.1,42.9.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[43.0.0-alpha.1,43.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[44.0.0-alpha.1,44.0.0-beta.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "electron", "source": "cna", "vendor": "electron"}, "product": "electron", "vendor": "electron"}], "created": "2026-09-29T23:30:19.056398+00:00", "updated": "2026-10-01T03:00:15.560197+00:00", "vendors": ["electron", "electron$PRODUCT$electron"]}