The vulnerability (CVE-2026-102674) in Electron occurs because windows opened from a sandboxed top-level document fail to inherit the sandbox restrictions defined by the HTML sandbox attribute. Consequently, content intended to be sandboxed can open new windows with the full origin privileges of the app, bypassing sandbox constraints. This issue specifically affects applications that render untrusted content in sandboxed top-level documents with popup permissions enabled. The vulnerability is addressed by returning an action to deny popups from untrusted content via setWindowOpenHandler or by upgrading to fixed Electron versions 41.10.6, 42.9.2, 43.4.1, or 44.0.0-beta.5.

This vulnerability can lead to privilege escalation where sandboxed content can escape sandbox restrictions by opening new windows with the app's full origin privileges. This undermines the security model of sandboxed content, potentially exposing sensitive data or allowing unauthorized actions within the Electron app. The impact is high due to the ability to bypass sandboxing and gain elevated privileges within the application context.

A fix is available in Electron versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Users should upgrade to these or later versions to remediate the vulnerability. As a workaround, applications can return { action: 'deny' } from setWindowOpenHandler for windows opened by untrusted content to prevent popup windows from bypassing sandbox restrictions.