An Electron application that uses the <webview> element can unintentionally grant a guest page the ability to enable Node.js in its Web Workers even when the embedder has disabled Node.js integration and sandboxing. By creating a worker that runs Node code, the attacker gains the privileges that the main application hand‑off intended to restrict, potentially allowing arbitrary local code execution or modification of application data.

Affected systems include the Electron framework for cross‑platform desktop applications. The problem exists in all Electron releases prior to 41.10.6, 42.9.2, 43.4.1, and the beta release 44.0.0‑beta.5. Applications that never employ the <webview> tag or that keep the embedder sandboxed are not impacted.

The CVSS base score of 8.3 indicates a high severity vulnerability. The EPSS score of < 1% suggests a low likelihood of exploitation, and the vulnerability is not yet listed in the CISA KEV catalog. In practice, an attacker would need to supply malicious content to an enabled webview within the application; this could occur through user interaction or compromised third‑party code. Once the malicious guest page creates a worker with Node integration, the attacker can execute code with the permissions of the host process.