Threats tagged 'ghsa-9f4c-93c8-jc8g'

A vulnerability in Electron allows sandboxed iframes without the 'allow-popups' permission to open new windows or trigger setWindowOpenHandler without user interaction. This occurs because new-window navigations using the OpenURL path do not enforce the iframe sandbox popup restriction. Applications embedding untrusted content in sandboxed iframes and relying solely on the absence of 'allow-popups' to prevent window creation are affected. Versions prior to 39.8.10 are vulnerable. Fixed versions include 39.8.10, 41.10.3, and 42.0.1.