Access Control Vulnerability in Electron Framework for Desktop Apps

CVE-2026-34765

What is CVE-2026-34765?

A vulnerability in the Electron framework allows a renderer to navigate a child window created by a different renderer if both use the same target name. This results from improper scoping of named-window lookups, leading to serious security implications. When a renderer calls window.open() with a target name, the child window can inherit elevated permissions, posing risks such as arbitrary code execution if certain insecure configurations are present, like enabling nodeIntegration or disabling sandboxing. The issue affects applications that leverage multiple top-level windows with varying trust levels while misconfiguring window preferences.

References