MediumGHSA-v93f-fgjr-hjrjCVE-2026-70607

Electron: window.open features string controls some window options considered privileged

Published 5 Aug 2026 · Updated 5 Aug 2026

Affected packages

electronnpm
Affected
<39.8.8
Fixed in
39.8.8
Update to the fixed version for your release line, for example:npm install electron@39.8.8
electronnpm
Affected
>=40.0.0-alpha.1 <40.9.0
Fixed in
40.9.0
Update to the fixed version for your release line, for example:npm install electron@40.9.0
electronnpm
Affected
>=41.0.0-alpha.1 <41.2.1
Fixed in
41.2.1
Update to the fixed version for your release line, for example:npm install electron@41.2.1
electronnpm
Affected
>=42.0.0-alpha.1 <42.0.0-beta.3
Fixed in
42.0.0-beta.3
Update to the fixed version for your release line, for example:npm install electron@42.0.0-beta.3

Details

Impact

Some window options supplied by web content in the window.open() features string were applied to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths.

Apps are only affected if untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler. Apps that deny window.open() for untrusted content, or set overrideBrowserWindowOptions explicitly, are not affected.

Workarounds

Return { action: 'deny' } from setWindowOpenHandler for untrusted content, or supply overrideBrowserWindowOptions so every window option is set explicitly.

Fixed Versions

  • 42.0.0-beta.3
  • 41.2.1
  • 40.9.0
  • 39.8.8

For more information

If you have any questions or comments about this advisory, email Electron at [security@electronjs.org](mailto:security@electronjs.org)

Is GHSA-v93f-fgjr-hjrj in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected electron, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.