CVE-2026-102676: Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
Impact
A <webview> could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed.
Apps are only affected if they enable the <webview> tag and the embedder is unsandboxed. Apps that do not use <webview>, or that keep the embedder sandboxed, are not affected.
Workarounds
Remove nodeIntegrationInWorker from the guest preferences in a will-attach-webview handler, or do not enable the <webview> tag when loading untrusted content.
Fixed Versions
44.0.0-beta.5 43.4.1 42.9.2 41.10.6
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 44.0.0-beta.5 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.4.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.9.2 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.10.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 41.10.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.9.2 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.4.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.0.0-beta.5 - Configuration
Remove nodeIntegrationInWorker from guest preferences in a will-attach-webview handler.
Electron <webview> nodeIntegrationInWorker = removed - Configuration
Do not enable the <webview> tag when loading untrusted content.
Electron <webview> <webview> tag = disabled
Event History
Frequently Asked Questions
Which Electron applications are affected?
An application is affected if it enables the <webview> tag and uses an unsandboxed embedder with Node.js integration disabled. Applications that do not enable <webview>, or that keep the embedder sandboxed, are not affected.
What does an attacker need to exploit this issue?
The attacker needs untrusted content running in an Electron <webview> guest and must be able to cause that guest to create a Web Worker with nodeIntegrationInWorker enabled. No privileges are required, but user interaction is required according to the supplied vector.
What is the impact if exploitation succeeds?
Untrusted guest content can create a Node-enabled Web Worker despite the embedder having Node.js integration disabled. This gives the worker more privilege than the embedder intended and can affect confidentiality, integrity, and availability.
Which versions contain the fix?
The issue is fixed in Electron 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.