Electron failed to enforce sandbox restrictions when a web page requested to open an external protocol URL. If an attacker crafts a sandboxed iframe that loads a URL such as a custom protocol or mailto link, the host OS will launch the registered application regardless of the sandbox state. This flaw allows an attacker to trigger the execution of any application registered for that protocol, potentially leading to local code execution or privilege escalation on the user’s machine.

The Electron framework, version 39.8.8, 40.9.0, 41.2.1, and 42.0.0‑beta.3 contain the fix; all earlier releases are affected. Users building applications with Electron before these releases could be impacted if they render untrusted content in sandboxed iframes and grant the openExternal permission implicitly.

The CVSS score of 5.4 indicates a moderate severity. EPSS is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack path is a client‑side web page loaded in an Electron application that includes sandboxed iframes containing external protocol URLs. An attacker needs only to supply such a page, and the effect is the unintended execution of an OS‑registered program. The threat is limited to systems where Electron applications render untrusted content with default openExternal permissions and lack a custom permission request handler.