OpenExternal permission requests have been mistakenly attributed to a document other than the one that initiated them, which means the requesting URL passed to session.setPermissionRequestHandler can be used by untrusted content to launch OS‑registered external applications. This flaw allows attackers to run any program the victim’s system has registered for a given protocol without proper origin verification.

Electron framework, version series before v42.11.3, v43.7.0, v44.3.0, and v45.0.0‑alpha.5, is affected. These builds handle external protocol URLs improperly. All Electron applications built on these versions are therefore vulnerable.

The CVSS score of 5.4 reflects a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet documented. However, the flaw can be leveraged by any untrusted web content loaded into an Electron app, allowing a malicious actor to launch arbitrary local applications if the app grants openExternal based on the request origin. The attack vector is likely via any embedded webview or renderer that processes untrusted content and interacts with the app’s permission handling logic.