Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application that loads untrusted content and permits it to open new windows could therefore allow that content to make a credentialed request to another site that relies on SameSite cookies for CSRF protection. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.
    Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new
    window from links as application-initiated navigations instead of preserving the page containing the link
    as the initiator. The resulting top-level request could be classified as same-site, causing
    SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application
    that loads untrusted content and permits it to open new windows could therefore allow that content to make
    a credentialed request to another site that relies on SameSite cookies for CSRF protection. This issue is
    fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6. (CVE-2026-113796)

ID	Name	Product	Family	Type	Severity
476847	SCA: security update for electron (GHSA-2p8c-gr87-2676)	Tenable Cloud Security	SCA Checks	Local	medium
476847	SCA: security update for electron (GHSA-2p8c-gr87-2676)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-113796

medium

Tenable Plugins

medium

medium