CVE-2026-114121
Published:October 21, 2026
Updated:October 23, 2026
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
Affected Packages
https://github.com/electron/electron.git (GITHUB):
Affected version(s) >=v42.0.0-alpha.1 <v42.11.3Fix Suggestion:
Update to version v42.11.3https://github.com/electron/electron.git (GITHUB):
Affected version(s) >=v43.0.0-alpha.1 <v43.7.0Fix Suggestion:
Update to version v43.7.0https://github.com/electron/electron.git (GITHUB):
Affected version(s) >=v44.0.0-alpha.1 <v44.3.0Fix Suggestion:
Update to version v44.3.0https://github.com/electron/electron.git (GITHUB):
Affected version(s) >=v45.0.0-alpha.1 <v45.0.0Fix Suggestion:
Update to version v45.0.0electron (NPM):
Affected version(s) >=44.0.0-alpha.1 <44.3.0Fix Suggestion:
Update to version 44.3.0electron (NPM):
Affected version(s) >=42.0.0-alpha.1 <42.11.3Fix Suggestion:
Update to version 42.11.3electron (NPM):
Affected version(s) >=45.0.0-alpha.1 <45.0.0Fix Suggestion:
Update to version 45.0.0electron (NPM):
Affected version(s) >=43.0.0-alpha.1 <43.7.0Fix Suggestion:
Update to version 43.7.0Related Resources (17)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Origin Validation Error
EPSS
Base Score:
0.18