CVE-2026-114121

Received Received - Intake

Protocol URL Spoofing in Electron Framework

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114121

EUVD

EUVD-2026-107361

Affected Vendors & Products

Vendor	Product	Version / Range
electron	electron	< 42.11.3
electron	electron	>= 43.0.0-alpha.1, < 43.7.0
electron	electron	>= 44.0.0-alpha.1, < 44.3.0
electron	electron	>= 45.0.0-alpha.1, < 45.0.0-alpha.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability in Electron involves incorrect attribution of permission requests for opening external protocol URLs. When a frame initiates a navigation to an external protocol (like magnet: or mailto:) and that frame is later removed or redirected, the permission request was incorrectly linked to the navigating page's origin instead of the original initiator. This could allow untrusted content to launch OS-registered external applications if the application grants openExternal permissions based on the requesting origin.

Impact Analysis

If you use an affected Electron version in an application that grants openExternal permissions based on the requesting origin and allows untrusted content to open windows, this vulnerability could allow malicious or compromised web content to launch external applications on your system without proper authorization. This might include opening email clients, file handlers, or other system applications.

Mitigation Strategies

Update Electron to versions 42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5 or later to address the vulnerability. If updating is not immediately possible, consider denying openExternal permission for untrusted content or using setWindowOpenHandler to restrict window opening as workarounds.

Hi! I’m here to help you understand CVE-2026-114121. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...