Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2026-114121: Electron apps may open external programs from untrusted content
CVE-2026-114121 · published 14 days ago
Summary
Older versions of Electron could mistakenly attribute a request to open a URL to a trusted page, even when the request came from a malicious source. This could let untrusted web content cause the computer to launch external applications, potentially exposing data or executing unwanted actions. Upgrade Electron to the latest release or apply the provided patches to ensure the correct origin is used for permission checks.
What to do
- Update electron to version 43.7.0.
- Update electron to version 44.3.0.
- Update electron to version 45.0.0-alpha.5.
- Update electron to version 42.11.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | electron | electron | < 42.11.3 |
| npm | – | electron |
>= 43.0.0-alpha.1, < 43.7.0 >= 44.0.0-alpha.1, < 44.3.0 >= 45.0.0-alpha.1, < 45.0.0-alpha.5 < 42.11.3 Fix: upgrade to 43.7.0
|
Original advisory text
Electron: openExternal permission requests can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
References
- https://github.com/electron/electron/security/advisories/GHSA-997q-gvvc-jwmx Vendor Advisory
- https://github.com/electron/electron/pull/53682 Patch
- https://github.com/electron/electron/pull/53696 Patch
- https://github.com/electron/electron/pull/53697 Patch
- https://github.com/electron/electron/pull/53698 Patch
- https://github.com/electron/electron/pull/53699 Patch
- https://nvd.nist.gov/vuln/detail/CVE-2026-114121 Vendor Advisory
- https://github.com/electron/electron/commit/25057643bf6d9a20bad69e45707551ccf546... Patch
- https://github.com/electron/electron/commit/8aa5414f73792ed3b2e3f9ab6391b1832e6d... Patch
- https://github.com/advisories/GHSA-997q-gvvc-jwmx
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-1141... Vendor Advisory
- https://github.com/electron/electron/commit/e3a400911084537bce7380ffea8af939572c... Patch
- https://github.com/electron/electron/releases/tag/v42.11.3 URL
- https://github.com/electron/electron/releases/tag/v43.7.0 URL
- https://github.com/electron/electron/releases/tag/v44.3.0 URL
- https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5 URL
- https://github.com/electron/electron/commit/92a783952891805f2f82f344c40a6917b98a... Patch
- https://github.com/electron/electron/commit/e0a20d5277b567aea8603f8e9852a4341407... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-346Origin Validation Error
Timeline
Published21 Oct 2026
Updated4 Nov 2026
First seen21 Oct 2026
Sources
CVE-2026-114121 · NVD
CVE-2026-114121 · MITRE
GHSA-997q-gvvc-jwmx · GHSA
CVE-2026-114121 · OSV
Track software like this
Free during beta