Threats tagged 'ghsa-gr2m-v5gq-v685'

Electron versions prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 contain a vulnerability where windows opened from a sandboxed top-level document do not inherit the document's HTML sandbox restrictions. This allows sandboxed content to open new windows with the app's full origin, potentially escalating privileges. The issue affects apps rendering untrusted content in sandboxed top-level documents that allow popups. Apps that deny popups from untrusted content using setWindowOpenHandler are not affected. Fixes are available in the specified versions.