The vulnerability arises when an Electron app embeds an iframe from a cross‑origin source that is not trusted. The framework allows that iframe to position the operating system’s native autofill popup outside its own bounds and over the app’s trusted UI, enabling clickjacking or spoofed form fields. This is a form of improper constraint handling (CWE‑1021).

Electron applications that use version 39.8.7 or earlier, 40.8.9 or earlier, 41.1.2 or earlier, or 42.0.0‑beta.2 or earlier and which embed untrusted or third‑party content in an iframe are vulnerable. Versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0‑beta.3 and newer include the fix. Applications that do not render any untrusted iframes are not affected.

The CVSS score of 3.1 indicates low overall severity, and no EPSS score is published, suggesting limited evidence of exploitation. Because the attack vector requires the application to load content that it treats as untrusted, the exploit is limited to applications that embed external iframes. The vulnerability is not included in CISA’s KEV list. An attacker who controls the iframe content could position the autofill popup over the trusted UI, enabling clickjacking or spoofing of UI elements.