Electron's navigation function OpenURLFromTab allows a sandboxed iframe that permits scripts and popups to open a new window without inheriting the parent iframe's sandbox restrictions. An attacker controlling such an iframe can cause the popup to load with the full origin of the host application, thereby gaining access to that application's cookies, storage, and same‑origin scripting capabilities. The flaw could expose sensitive data and allow the attacker to execute arbitrary JavaScript within the context of the host application's origin, effectively letting a malicious iframe gain the privileges of the application. The vulnerability is identified as CWE‑346, CWE‑693 and CWE‑281 because it stems from missing authorization checks when copying sandbox constraints, improper control of resource usage across contexts, and an improper restriction of rendered HTML.

All applications built with Electron prior to release 41.10.4, 42.5.2, or 43.0.0 are susceptible. This includes desktop software that embeds untrusted web content in sandboxed iframes with the allow‑scripts and allow‑popups attributes enabled. The affected component is Electron's OpenURLFromTab navigation path, used for opening links with target="_blank" or middle‑click behavior.

The CVSS score is 8.2, classifying the vulnerability as high severity. The EPSS score of 0.00147 indicates a very low but non-zero probability of exploitation. The flaw is not listed in CISA's KEV catalog, suggesting limited known exploitation yet significant risk. The most likely attack vector is local or file‑based: an attacker could supply a crafted web page or malicious iframe within a trusted Electron application, thereby triggering the popup behavior. If the user interacts with the iframe, the attacker could compromise application credentials or inject malicious scripts, leading to data leakage or unauthorized system control.