Electron, a framework for building desktop applications with web technologies, has a flaw in which a sandboxed iframe that does not specify the allow-popups attribute can still open new windows or invoke setWindowOpenHandler through navigations that take the OpenURL path. This bypass allows embedded untrusted content to create pop‑ups or otherwise change the windowing context without the user’s consent, potentially leading to unwanted pop‑ups, phishing attempts, or other disruptive behaviors. The weakness is identified as a sandbox escape and unvalidated control flow.

Applications built with Electron versions prior to 39.8.10, 41.10.3, or 42.0.1 that embed untrusted content in sandboxed iframes without the allow-popups keyword are vulnerable. Applications that explicitly deny window creation in setWindowOpenHandler or that do not embed untrusted content in sandboxed iframes are not affected.

The CVSS score of 7.2 classifies the flaw as high severity. No EPSS score is available, so current exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote content—an adversary can host malicious content in an iframe that is loaded by the application. If the app permits that content, the attacker could silently open pop‑ups or hijack the window with no user interaction. The primary impact is the violation of sandbox restrictions and potential for malicious pop‑ups or undesired script execution.