Improper Handling of External Protocol URLs in Electron Framework
CVE-2026-114121
5.4MEDIUM
What is CVE-2026-114121?
The Electron framework, a popular tool for building cross-platform desktop applications, contains a vulnerability that allows requests to open external protocol URLs to be misattributed to the wrong document. This flaw could enable untrusted content to exploit the application's permission settings, potentially allowing it to open or navigate external applications that the operating system recognizes. Versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5 provide fixes addressing this issue, enhancing overall security for applications utilizing Electron.
Affected Version(s)
electron < 42.11.3 < 42.11.3
electron >= 43.0.0-alpha.1, < 43.7.0 < 43.0.0-alpha.1, 43.7.0
electron >= 44.0.0-alpha.1, < 44.3.0 < 44.0.0-alpha.1, 44.3.0