An Electron framework defect permitted windows opened from a sandboxed top-level document to ignore that document’s HTML sandbox restrictions. The vulnerable logic caused the new window to run with the Electron application’s full origin, effectively removing the sandbox’s intended isolation. The weakness is a form of authorization bypass (CWE‑266) with an accompanying audit failure (CWE‑693). When untrusted content in a sandboxed document is allowed to invoke popup creation, the attacker can elevate privileges within the application context. No other system compromise is described; the attack vector is the ability to embed or inject untrusted code into a sandboxed top-level document that is permitted to opening windows.

All Electron releases older than v41.10.6, v42.9.2, v43.4.1, and v44.0.0‑beta.5 are affected. This includes Electron 41.10.5 and earlier, 42.9.1 and earlier, 43.4.0 and earlier, and any pre‑beta 44.0.0 revisions. Applications that rely on Electron for desktop UI should verify their installed version against these boundaries.

The vulnerability carries a high CVSS score of 8.2, indicating significant impact if exploited. EPSS data is unavailable, but the issue is not listed in the CISA KEV catalog, suggesting it has not yet been widely observed in the wild. Exploitation requires that the application allow popups from a sandboxed top-level document; applications that explicitly deny such popups with setWindowOpenHandler remain unaffected. An attacker who can supply untrusted content to the sandboxed document can create a window that runs at the application's full origin, potentially exposing sensitive data or allowing execution of malicious code within the application environment.