CVE-2026-114121: Electron: openExternal permission requests can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.7.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.3.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.5
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they grant openExternal permission based on the requesting origin and permit untrusted content to open or navigate windows. In that configuration, untrusted content may cause an OS-registered external application to be launched.
What must an attacker be able to do to exploit this?
An attacker needs untrusted content to be able to open or navigate a window in the application. Exploitation also depends on the application using session.setPermissionRequestHandler to approve openExternal requests based on a trusted requesting origin.
How can I determine whether my application is affected?
Review uses of session.setPermissionRequestHandler for decisions that grant openExternal based on requestingUrl or its origin. Also determine whether untrusted content can open or navigate windows and whether the Electron version is earlier than 42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5.
What can be done if upgrading Electron is not immediately possible?
Do not grant openExternal solely based on the requesting origin where untrusted content can open or navigate windows. Restrict untrusted content from opening or navigating windows to reduce the conditions required for exploitation.