Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions (CVE-2026-102676)
A vulnerability in Electron's <webview> tag allows Node.js integration to be enabled in Web Workers even when the embedder disables it, potentially granting guest content elevated privileges. This affects applications that enable the <webview> tag and run without sandboxing. The issue is fixed in Electron versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Workarounds include removing nodeIntegrationInWorker from guest preferences or avoiding <webview> usage with untrusted content.
AI Analysis
Technical Summary
CVE-2026-102676 is a vulnerability in Electron where a <webview> can enable Node.js integration in its Web Workers despite the embedder having Node.js integration disabled. This flaw allows guest content to gain more privileges than intended by the embedder. The vulnerability only affects applications that enable the <webview> tag and run without sandboxing. Electron has released fixes in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Workarounds include removing the nodeIntegrationInWorker setting from guest preferences or not enabling <webview> when loading untrusted content.
Potential Impact
The vulnerability allows guest content loaded in a <webview> to execute Node.js code within Web Workers even when the embedder disables Node.js integration. This escalates privileges beyond what the embedder intended, potentially compromising application security. Only unsandboxed embedders that enable <webview> are affected. Applications that do not use <webview> or keep the embedder sandboxed are not impacted.
Mitigation Recommendations
A fix is available in Electron versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Users should upgrade to one of these versions to remediate the vulnerability. As a workaround, remove the nodeIntegrationInWorker preference in the will-attach-webview event handler or avoid enabling the <webview> tag when loading untrusted content.
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions (CVE-2026-102676)
Description
A vulnerability in Electron's <webview> tag allows Node.js integration to be enabled in Web Workers even when the embedder disables it, potentially granting guest content elevated privileges. This affects applications that enable the <webview> tag and run without sandboxing. The issue is fixed in Electron versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Workarounds include removing nodeIntegrationInWorker from guest preferences or avoiding <webview> usage with untrusted content.
CVSS v3.1
Score 8.3high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-102676 is a vulnerability in Electron where a <webview> can enable Node.js integration in its Web Workers despite the embedder having Node.js integration disabled. This flaw allows guest content to gain more privileges than intended by the embedder. The vulnerability only affects applications that enable the <webview> tag and run without sandboxing. Electron has released fixes in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Workarounds include removing the nodeIntegrationInWorker setting from guest preferences or not enabling <webview> when loading untrusted content.
Potential Impact
The vulnerability allows guest content loaded in a <webview> to execute Node.js code within Web Workers even when the embedder disables Node.js integration. This escalates privileges beyond what the embedder intended, potentially compromising application security. Only unsandboxed embedders that enable <webview> are affected. Applications that do not use <webview> or keep the embedder sandboxed are not impacted.
Mitigation Recommendations
A fix is available in Electron versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Users should upgrade to one of these versions to remediate the vulnerability. As a workaround, remove the nodeIntegrationInWorker preference in the will-attach-webview event handler or avoid enabling the <webview> tag when loading untrusted content.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9qh4-3jw8-366w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-102676"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6abc27cf680226ef6846f91f
Added to database: 09/29/2026, 21:04:15 UTC
Last enriched: 09/29/2026, 21:22:33 UTC
Last updated: 09/30/2026, 03:19:35 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.