Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
    Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's     OpenURLFromTab navigation path, including links using target=_blank or a middle-click, did not receive     the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups     configuration could therefore open a popup with the embedding application's full origin, exposing that     origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed     untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2,     and 43.0.0. (CVE-2026-102673)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
    Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's
    OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive
    the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups
    configuration could therefore open a popup with the embedding application's full origin, exposing that
    origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed
    untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2,
    and 43.0.0. (CVE-2026-102673)

ID	Name	Product	Family	Type	Severity
362441	Linux Distros Unpatched Vulnerability : CVE-2026-102673	Nessus	Misc.	Local	high
448465	SCA: security update for electron (GHSA-hq2x-r82h-9wj4)	Tenable Cloud Security	SCA Checks	Local	high
448465	SCA: security update for electron (GHSA-hq2x-r82h-9wj4)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-102673

high

Tenable Plugins

high

high

high