CVE-2026-4643: Calling window.close() from server-side content causes crash in the Mattermost Desktop App
Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking {{window.close()}} in the renderer context, leading to a denial of service condition at the client level. Mattermost Advisory ID: MMSA-2026-00633
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4643?
CVE-2026-4643 is classified as a medium-severity vulnerability due to its potential to crash the Mattermost Desktop App.
How do I fix CVE-2026-4643?
To mitigate CVE-2026-4643, upgrade to Mattermost Desktop App version 6.2 or later.
Which versions of Mattermost Desktop App are affected by CVE-2026-4643?
CVE-2026-4643 affects Mattermost Desktop App versions 5.4.13.0, 6.0.1, and all versions up to and including 6.1.
What causes the CVE-2026-4643 vulnerability?
CVE-2026-4643 is caused by the inability of the Mattermost Desktop App to prevent server-rendered content from executing window.close(), leading to application crashes.
What are the potential impacts of CVE-2026-4643?
The potential impacts of CVE-2026-4643 include crashes in the Mattermost Desktop App, which can disrupt user sessions.