CVE-2026-114121

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.

• CWE-346

• https://github.com/electron/electron/commit/25057643bf6d9a20bad69e45707551ccf546f5ce
• https://github.com/electron/electron/commit/8aa5414f73792ed3b2e3f9ab6391b1832e6dc2c3
• https://github.com/electron/electron/commit/92a783952891805f2f82f344c40a6917b98a7d98
• https://github.com/electron/electron/commit/e0a20d5277b567aea8603f8e9852a4341407a586
• https://github.com/electron/electron/commit/e3a400911084537bce7380ffea8af939572ce8dd
• https://github.com/electron/electron/pull/53682
• https://github.com/electron/electron/pull/53696
• https://github.com/electron/electron/pull/53697
• https://github.com/electron/electron/pull/53698
• https://github.com/electron/electron/pull/53699
• https://github.com/electron/electron/releases/tag/v42.11.3
• https://github.com/electron/electron/releases/tag/v43.7.0
• https://github.com/electron/electron/releases/tag/v44.3.0
• https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5
• https://github.com/electron/electron/security/advisories/GHSA-997q-gvvc-jwmx

Published

Oct 21, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114116Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 buil…5.3
• CVE-2026-114117Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompila…5.9
• CVE-2026-114118Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint…4.8
• CVE-2026-114119Best Practice Software Bp Premier before 1.14.1.1128 uses a …9.8
• CVE-2026-11412A weakness has been identified in Jinher OA C6. The affected…6.3
• CVE-2026-114120SchedulePress before 5.3.5 contains a missing authorization …5.4
• CVE-2026-114122Electron is a framework for writing cross-platform desktop a…3.9
• CVE-2026-114123D365 F&O MCP Server is a Model Context Protocol server for q…7.5
• CVE-2026-114124Electron is a framework for writing cross-platform desktop a…3.9
• CVE-2026-114125Storybook is a frontend workshop for building user interface…8.6
• CVE-2026-114126Storybook is a frontend workshop for building user interface…8.7
• CVE-2026-114127Astro is a web framework for content-driven websites. From 7…2.3