CVE-2026-102676

Analyzed Analyzed - Analysis Complete

Node.js Integration Bypass in Electron WebView

Publication date: 2026-09-29

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the <webview> tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102676

EUVD

EUVD-2026-89095

Affected Vendors & Products

Vendor	Product	Version / Range
electronjs	electron	to 41.10.6 (exc)
electronjs	electron	From 42.0.0 (inc) to 42.9.2 (exc)
electronjs	electron	From 43.0.0 (inc) to 43.4.1 (exc)
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Electron applications using the webview tag. A guest in a webview could enable Node.js integration in Web Workers even when the main application had it disabled. This allows untrusted content to create privileged workers with more access than intended. Only applications using webview without sandboxing are affected.

Detection Guidance

To detect this vulnerability, check if your Electron application uses the <webview> tag with an unsandboxed embedder and verify the Electron version. Use commands like 'electron --version' to check the version. If the version is below 41.10.6, 42.9.2, 43.4.1, or 44.0.0-beta.5, the system is vulnerable. Inspect application code for <webview> usage and ensure nodeIntegrationInWorker is not enabled in guest preferences.

Impact Analysis

If you use an affected Electron version with webview enabled and no sandbox, malicious web content could execute arbitrary code on your system with elevated privileges. This could lead to data theft, system compromise, or further network attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's patient privacy rules. Organizations must patch to maintain compliance.

Mitigation Strategies

Update Electron to versions 41.10.6, 42.9.2, 43.4.1, or 44.0.0-beta.5 or later to address the vulnerability. Ensure applications do not enable the <webview> tag or keep the embedder sandboxed.

Hi! I’m here to help you understand CVE-2026-102676. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70