CVE-2026-70608: High severity npm/electron vulnerability
Impact A sandboxed iframe without the allow-popups keyword could still open a new window (or trigger setWindowOpenHandler) with no user interaction, because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction.
Apps that embed untrusted content in sandboxed iframes and rely on the absence of allow-popups to prevent window creation are affected. Apps that deny window creation in setWindowOpenHandler, or that do not embed untrusted content in sandboxed iframes, are not affected.
Workarounds Return { action: 'deny' } from setWindowOpenHandler for any content you do not trust, rather than relying on the iframe sandbox alone.
Fixed Versions 42.0.1 41.10.3 39.8.10
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.10 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.10.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 39.8.10 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 41.10.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.0.1 - Configuration
For any content you do not trust, modify setWindowOpenHandler to return `{ action: 'deny' }` instead of relying on the iframe sandbox (e.g., absence of `allow-popups`).
Electron / setWindowOpenHandler setWindowOpenHandler return value = { action: 'deny' }