Electron treats pages opened via links as application‑initiated navigations before version 42.11.3, 43.7.0, 44.3.0, and 45.0.0‑alpha.6, causing the top‑level request to be classified as same‑site. This allows SameSite=Strict cookies to be sent and the Sec‑Fetch‑Site header to omit the initiating page, letting an attacker in a loaded untrusted page send credentialed requests to other sites that rely on SameSite cookies for CSRF protection.

All Electron applications built with the affected releases that load untrusted web content and allow links to open new windows are vulnerable. Versions earlier than 42.11.3, 43.7.0, 44.3.0, and 45.0.0‑alpha.6 are impacted.

The CVSS score of 4.2 indicates low severity; the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by having an Electron app load an external page that uses window.open from a link; the resulting same‑site context bypasses SameSite restrictions and enables credentialed requests to other sites that rely on SameSite cookies for CSRF protection. The attack vector is inferred from the description as an Electron application that loads untrusted content and permits links to open new windows.