Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114121— Electron: openExternal permission requests can be attributed to the wrong origin

Quick assessment

Affected
electron electron
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Electron 是一个用于使用 JavaScript、HTML 和 CSS 开发跨平台桌面应用程序的框架。在版本 42.11.3、43.7.0、44.3.0 和 45.0.0-alpha.5 之前，打开外部协议 URL 的请求可能被错误地归因于非发起该请求的文档，导致 接收到的 将不可信内容发起的启动请求误判为可信内容。因此，若应用程序依据请求来源（origin）授予 权限，并允许不可信内容打开或导航至新窗口，则攻击者可借此利用不可信内容启动操作系统注册的外部应用程序。该问题已在版本 42.11.3、43.7.0

CVSS 5.4 · Medium

Affected Version Matrix 4

VendorProduct Version RangeStatus
electron electron < 42.11.3 affected
>= 43.0.0-alpha.1, < 43.7.0 affected
>= 44.0.0-alpha.1, < 44.3.0 affected
>= 45.0.0-alpha.1, < 45.0.0-alpha.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114121

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Electron: openExternal permission requests can be attributed to the wrong origin
Source: CVE Program / CVE List V5
Vulnerability Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
electron electron < 42.11.3 -

II. Public POCs for CVE-2026-114121

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114121

请登录查看更多情报信息。

Other References for CVE-2026-114121 (15)

Same Patch Batch · electron · 2026-10-21 · 7 CVEs total

CVE-2026-113800 5.4 MEDIUM Electron: HID and USB permission checks can be attributed to the wrong origin
CVE-2026-113798 5.4 MEDIUM Electron: Pointer lock permission requests can be attributed to the wrong frame
CVE-2026-113796 4.2 MEDIUM Electron: SameSite cookie restrictions are not applied to windows opened from links
CVE-2026-114122 3.9 LOW Electron: Frame subscription trusts GPU-supplied frame geometry
CVE-2026-114124 3.9 LOW Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
CVE-2026-113797 3.1 LOW Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

IV. Related Vulnerabilities

Same product: electron
Same vendor: electron
Same weakness: CWE-346

V. Comments for CVE-2026-114121

No comments yet

Leave a comment