Electron versions prior to 41.10.4, between 42.0.0-alpha.1 and 42.5.2, and between 43.0.0-alpha.1 and 43.0.0 allowed popups opened from sandboxed iframes with 'allow-scripts allow-popups' to drop sandbox restrictions. This enabled sandboxed content to open popups with the embedding app's full origin, potentially accessing cookies, storage, and same-origin scripting. The issue affects apps embedding untrusted content in sandboxed iframes with these permissions. Fixed versions are 41.10.4, 42.5.2, and 43.0.0.