SameSite Cookie Misconfiguration in Electron Framework
CVE-2026-113796

4.2MEDIUM

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
21 October 2026

What is CVE-2026-113796?

The Electron framework incorrectly handled new window navigations initiated by application pages, leading to a SameSite cookie misconfiguration. This issue allowed untrusted content to make credentialed requests to other sites that depend on SameSite cookies for Cross-Site Request Forgery (CSRF) protection. The vulnerability was addressed in subsequent releases, enhancing the framework's security posture.

Affected Version(s)

electron < 42.11.3 < 42.11.3

electron >= 43.0.0-alpha.1, < 43.7.0 < 43.0.0-alpha.1, 43.7.0

electron >= 44.0.0-alpha.1, < 44.3.0 < 44.0.0-alpha.1, 44.3.0

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM
https://github.com/electron/electron/pull/53683
x_refsource_MISC
https://github.com/electron/electron/pull/53717
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.