CVE-2026-34765

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34765", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T19:54:55.554Z", "datePublished": "2026-04-07T21:18:35.375Z", "dateUpdated": "2026-04-13T15:37:12.686Z"}, "containers": {"cna": {"title": "Electron named window.open targets not scoped to the opener's browsing context", "problemTypes": [{"descriptions": [{"cweId": "CWE-668", "lang": "en", "description": "CWE-668: Exposure of Resource to Wrong Sphere", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8"}], "affected": [{"vendor": "electron", "product": "electron", "versions": [{"version": "< 39.8.5", "status": "affected"}, {"version": ">= 40.0.0-alpha.1, < 40.8.5", "status": "affected"}, {"version": ">= 41.0.0-alpha.1, < 41.1.0", "status": "affected"}, {"version": ">= 42.0.0-alpha.1, < 42.0.0-alpha.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T21:18:35.375Z"}, "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5."}], "source": {"advisory": "GHSA-f3pv-wv63-48x8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T03:56:10.527333Z", "id": "CVE-2026-34765", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:37:12.686Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34765", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T03:56:10.527333Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:30:52.559Z"}}], "cna": {"title": "Electron named window.open targets not scoped to the opener's browsing context", "source": {"advisory": "GHSA-f3pv-wv63-48x8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "electron", "product": "electron", "versions": [{"status": "affected", "version": "< 39.8.5"}, {"status": "affected", "version": ">= 40.0.0-alpha.1, < 40.8.5"}, {"status": "affected", "version": ">= 41.0.0-alpha.1, < 41.1.0"}, {"status": "affected", "version": ">= 42.0.0-alpha.1, < 42.0.0-alpha.5"}]}], "references": [{"url": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8", "name": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-668", "description": "CWE-668: Exposure of Resource to Wrong Sphere"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T21:18:35.375Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34765", "state": "PUBLISHED", "dateUpdated": "2026-04-13T15:37:12.686Z", "dateReserved": "2026-03-30T19:54:55.554Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T21:18:35.375Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "electron", "vendor": "electron", "versions": [{"status": "affected", "version": "< 39.8.5"}, {"status": "affected", "version": ">= 40.0.0-alpha.1, < 40.8.5"}, {"status": "affected", "version": ">= 41.0.0-alpha.1, < 41.1.0"}, {"status": "affected", "version": ">= 42.0.0-alpha.1, < 42.0.0-alpha.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "239C939D-31F6-414C-AF8A-385ADA0F2A17", "versionEndIncluding": "39.8.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "8190FCCE-AFCA-4D8C-BF8B-C8A3996B0D9D", "versionEndIncluding": "40.8.4", "versionStartIncluding": "40.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "A87A2631-72BF-432E-B014-AEFE45CB9BAE", "versionEndExcluding": "41.1.0", "versionStartIncluding": "41.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:41.2.0:*:*:*:*:node.js:*:*", "matchCriteriaId": "AE2BDFE9-435B-4E7A-9785-0805EE1AED4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "498062D8-5C83-4FC2-A04B-94F3228B2BED", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "A272F9F4-AB62-407C-B1A8-18586A474C19", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "BF49E260-9653-4D26-8B6C-C6FAFE697F5A", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:42.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "2F3B609A-0CA5-4E8C-865E-CF79B6B0CCCC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, when a renderer calls window.open() with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive webPreferences (via setWindowOpenHandler's overrideBrowserWindowOptions), content loaded by the second renderer inherits those permissions. Apps are only affected if they open multiple top-level windows with differing trust levels and use setWindowOpenHandler to grant child windows elevated webPreferences such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected. Apps that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to the security recommendations) may be exposed to arbitrary code execution. This vulnerability is fixed in 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5."}, {"lang": "es", "value": "Electron es un framework para escribir aplicaciones de escritorio multiplataforma usando JavaScript, HTML y CSS. Antes de 39.8.5, 40.8.5, 41.1.0 y 42.0.0-alpha.5, cuando un renderizador llama a window.open() con un nombre de destino, Electron no delimitaba correctamente la b\u00fasqueda de la ventana con nombre al grupo de contexto de navegaci\u00f3n del abridor. Un renderizador pod\u00eda navegar una ventana secundaria existente que fue abierta por un renderizador diferente y no relacionado si ambos usaban el mismo nombre de destino. Si esa ventana secundaria existente fue creada con webPreferences m\u00e1s permisivas (a trav\u00e9s de overrideBrowserWindowOptions de setWindowOpenHandler), el contenido cargado por el segundo renderizador hereda esos permisos. Las aplicaciones solo se ven afectadas si abren m\u00faltiples ventanas de nivel superior con diferentes niveles de confianza y usan setWindowOpenHandler para otorgar a las ventanas secundarias webPreferences elevadas, como un script de precarga privilegiado. Las aplicaciones que no elevan los privilegios de las ventanas secundarias, o que usan una \u00fanica ventana de nivel superior, no se ven afectadas. Las aplicaciones que adem\u00e1s otorgan nodeIntegration: true o sandbox: false a las ventanas secundarias (contrario a las recomendaciones de seguridad) pueden estar expuestas a ejecuci\u00f3n de c\u00f3digo arbitrario. Esta vulnerabilidad est\u00e1 corregida en 39.8.5, 40.8.5, 41.1.0 y 42.0.0-alpha.5."}], "id": "CVE-2026-34765", "lastModified": "2026-07-24T22:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34765", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T03:56:10.527333Z", "version": "2.0.3"}}]}, "published": "2026-04-07T22:16:22.960", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "electron: Electron: Arbitrary code execution or information disclosure via incorrect window handling", "id": "2456278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456278"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-653", "details": ["A flaw was found in Electron, a framework for building desktop applications. This vulnerability allows a malicious component within an Electron application to hijack an existing child window opened by another part of the application if both use the same window name. This could lead to the malicious component inheriting elevated security permissions, potentially resulting in unauthorized information disclosure or, in specific configurations, arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, Electron application developers should avoid granting elevated `webPreferences` to child windows, particularly `nodeIntegration: true` or `sandbox: false`, when using `setWindowOpenHandler`. Applications should also ensure consistent trust levels across multiple top-level windows or avoid using named windows with `window.open()` across different trust contexts."}, "name": "CVE-2026-34765", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Affected", "package_name": "podman-desktop-macos-1-0", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Affected", "package_name": "podman-desktop-windows-1-0", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:podman_desktop:0", "fix_state": "Affected", "package_name": "redhat-user-workloads/openshift-local-ext", "product_name": "Red Hat Build of Podman Desktop - Tech Preview"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "podman-desktop", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rh-podman-desktop", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-04-07T21:18:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-34765\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34765\nhttps://github.com/electron/electron/security/advisories/GHSA-f3pv-wv63-48x8"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,39.8.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[40.0.0-alpha.1,40.8.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[41.0.0-alpha.1,41.1.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[42.0.0-alpha.1,42.0.0-alpha.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "electron", "source": "cna", "vendor": "electron"}, "product": "electron", "vendor": "electron"}], "analysis": {"en": {"generated_at": "2026-04-08T13:22:58.792422+00:00", "value": {"mitigation_remediation": ["Upgrade Electron to version 39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5 or later, where the bug is fixed."], "summary": {"action": "Patch Immediately", "impact": "Potential arbitrary code execution via privilege escalation"}, "threat_synthesis": {"affected_systems": "The issue affects applications built with the Electron framework before the specified fixed releases. Impacted apps are those that open multiple top\u2011level windows with differing trust levels and employ the setWindowOpenHandler API to grant child windows elevated webPreferences. Applications that do not elevate child window privileges, or that use only a single top\u2011level window, are not affected. If an app also grants nodeIntegration:true or sandbox:false to child windows\u2014contrary to recommended security practices\u2014then the vulnerability could lead to arbitrary code execution.", "description_and_impact": "Electron versions prior to 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5 fail to isolate named window targets within the same browsing context group. A renderer can navigate an existing child window that was opened by a different, unrelated renderer if both specify the same target name. Because the existing child may have been created with elevated webPreferences\u2014such as a privileged preload script or node integration\u2014this mis\u2011scoping allows the second renderer to implicitly inherit those higher permissions. An attacker who can control a renderer that opens a target name shared with a privileged window can potentially execute arbitrary code in the context of that elevated child window, leading to serious confidentiality and integrity risks.", "risk_and_exploitability": "The CVSS score of 6.0 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in KEV. The attack vector is likely local, requiring the attacker to influence the renderer that opens the shared target name. Since the flaw depends on developer configuration choices rather than a generic exploit, successful exploitation would require that an application opens multiple windows with differing permissions and uses the same named target across those windows. Consequently, the risk is significant for misconfigured Electron applications but limited for those following the default security guidelines."}}}}, "created": "2026-04-08T19:34:08.642420+00:00", "updated": "2026-04-08T19:45:34.592170+00:00", "vendors": ["electron", "electron$PRODUCT$electron"]}