{"schema_version":"1","data":[{"id":20786,"advisory_id":"02206b69-6a9e-490f-add9-66e17c920670","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102672","source_published_at":"2026-10-13T15:52:46.436+00:00","published_at":"2026-10-25T05:34:10.29931+00:00","extraction_method":"structured","technologies":["core-cve","electron"],"cve_ids":["CVE-2026-102672"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Electron: Local race condition in Squirrel.Mac update installation on macOS","summary":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.","evidence":"cve:CVE-2026-102672","products":[{"name":{"value":"electron","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102672","aliases":["CVE-2026-102672"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.7,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"electron","product":"electron","versions":[{"status":"affected","version":"< 39.8.10"},{"status":"affected","version":">= 40.0.0-alpha.1, < 41.10.5"},{"status":"affected","version":">= 42.0.0-alpha.1, < 42.0.0-beta.2"}]}],"modified":"2026-10-13T20:22:22.127Z","provider":"cve","references":["https://github.com/electron/electron/security/advisories/GHSA-vv43-5jgx-7qv8","https://github.com/electron/electron/pull/50745","https://github.com/electron/electron/commit/01faabfc250801a980fc94d64608046c67fc1cd9","https://github.com/electron/electron/commit/15e2928a5c5f01759107b414010e220d90d59cef","https://github.com/electron/electron/commit/a0f9ff4cc0340545008424232d49caadd9c0c767","https://github.com/electron/electron/commit/b8f25c4cedb2e0f5f475912b709aba19c57c26be","https://github.com/electron/electron/releases/tag/v39.8.10","https://github.com/electron/electron/releases/tag/v41.10.5","https://github.com/electron/electron/releases/tag/v42.0.0-beta.2"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102672","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-13T20:14:15.326288Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T20:22:22.127Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-13T15:52:46.436Z"}}},"related_cves":[{"value":"CVE-2026-102672","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":7895,"advisory_id":"9c62b17d-13de-45ce-be49-b8e9914515b0","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102677","source_published_at":"2026-09-29T17:43:26.96+00:00","published_at":"2026-10-24T22:52:20.312553+00:00","extraction_method":"structured","technologies":["core-cve","electron"],"cve_ids":["CVE-2026-102677"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer","summary":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the renderer's code in the more privileged preload context. The issue affects applications that load untrusted content. This issue is fixed in versions 42.10.0, 43.5.0, and 44.0.0-beta.6.","evidence":"cve:CVE-2026-102677","products":[{"name":{"value":"electron","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102677","aliases":["CVE-2026-102677"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"electron","product":"electron","versions":[{"status":"affected","version":">= 42.3.3, < 42.10.0"},{"status":"affected","version":">= 43.0.0-beta.1, < 43.5.0"},{"status":"affected","version":">= 44.0.0-alpha.1, < 44.0.0-beta.6"}]}],"modified":"2026-10-02T12:18:18.477Z","provider":"cve","references":["https://github.com/electron/electron/security/advisories/GHSA-qmv3-fv6v-rmhq","https://github.com/electron/electron/pull/52480","https://github.com/electron/electron/commit/000453e399bd1dee5e86376cdd9ece5fc071e601","https://github.com/electron/electron/commit/25ba8be57c65a83d8c14ebb8aa37693df17a04f3","https://github.com/electron/electron/commit/c38d6fd68756f04647ea857bdb6a2abec332e217","https://github.com/electron/electron/releases/tag/v42.10.0","https://github.com/electron/electron/releases/tag/v43.5.0","https://github.com/electron/electron/releases/tag/v44.0.0-beta.6"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102677","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T12:18:07.959498Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T12:18:18.477Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T17:43:26.960Z"}}},"related_cves":[{"value":"CVE-2026-102677","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4892,"advisory_id":"2f1fa93a-6f32-4a5b-aa20-57d37c7af667","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102673","source_published_at":"2026-09-29T16:38:41.946+00:00","published_at":"2026-10-24T21:59:17.740847+00:00","extraction_method":"structured","technologies":["core-cve","electron"],"cve_ids":["CVE-2026-102673"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab","summary":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target=\"_blank\" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popups configuration could therefore open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities. Applications that do not embed untrusted content in sandboxed iframes are not affected. This issue is fixed in versions 41.10.4, 42.5.2, and 43.0.0.","evidence":"cve:CVE-2026-102673","products":[{"name":{"value":"electron","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102673","aliases":["CVE-2026-102673"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"electron","product":"electron","versions":[{"status":"affected","version":"< 41.10.4"},{"status":"affected","version":">= 42.0.0-alpha.1, < 42.5.2"},{"status":"affected","version":">= 43.0.0-alpha.1, < 43.0.0"}]}],"modified":"2026-09-30T20:11:08.290Z","provider":"cve","references":["https://github.com/electron/electron/security/advisories/GHSA-hq2x-r82h-9wj4","https://github.com/electron/electron/pull/52133","https://github.com/electron/electron/commit/7ea14d5f55ecb11a30447701ddca16b3feee0bba","https://github.com/electron/electron/commit/e26b2640e7795c42bfb111b76009cbb4327c9a69","https://github.com/electron/electron/commit/ebe1165ee2b05c203c26dd2244ef1c5b9b1c04da","https://github.com/electron/electron/releases/tag/v41.10.4","https://github.com/electron/electron/releases/tag/v42.5.2","https://github.com/electron/electron/releases/tag/v43.0.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102673","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T19:34:09.694143Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:11:08.290Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T16:38:41.946Z"}}},"related_cves":[{"value":"CVE-2026-102673","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3997,"advisory_id":"0042970a-66ea-40e7-bdd0-019b5d8f175a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102676","source_published_at":"2026-09-29T16:56:49.007+00:00","published_at":"2026-10-24T21:44:46.702098+00:00","extraction_method":"structured","technologies":["core-cve","electron"],"cve_ids":["CVE-2026-102676"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Electron: can enable Node.js integration in Web Workers despite embedder restrictions","summary":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted. Applications that do not enable the tag or that keep the embedder sandboxed are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.","evidence":"cve:CVE-2026-102676","products":[{"name":{"value":"electron","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102676","aliases":["CVE-2026-102676"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"electron","product":"electron","versions":[{"status":"affected","version":"< 41.10.6"},{"status":"affected","version":">= 42.0.0-alpha.1, < 42.9.2"},{"status":"affected","version":">= 43.0.0-alpha.1, < 43.4.1"},{"status":"affected","version":">= 44.0.0-alpha.1, < 44.0.0-beta.5"}]}],"modified":"2026-09-29T19:50:28.382Z","provider":"cve","references":["https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w","https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2","https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671","https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886","https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae","https://github.com/electron/electron/releases/tag/v41.10.6","https://github.com/electron/electron/releases/tag/v42.9.2","https://github.com/electron/electron/releases/tag/v43.4.1","https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102676","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T19:50:13.282220Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T19:50:28.382Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T16:56:49.007Z"}}},"related_cves":[{"value":"CVE-2026-102676","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3868,"advisory_id":"1c308946-7fa4-4869-ad6f-768f07007f16","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102675","source_published_at":"2026-09-29T16:54:29.218+00:00","published_at":"2026-10-24T21:42:37.503247+00:00","extraction_method":"structured","technologies":["core-cve","electron"],"cve_ids":["CVE-2026-102675"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled","summary":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.","evidence":"cve:CVE-2026-102675","products":[{"name":{"value":"electron","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102675","aliases":["CVE-2026-102675"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.4,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"electron","product":"electron","versions":[{"status":"affected","version":"< 41.10.6"},{"status":"affected","version":">= 42.0.0-alpha.1, < 42.9.2"},{"status":"affected","version":">= 43.0.0-alpha.1, < 43.4.1"},{"status":"affected","version":">= 44.0.0-alpha.1, < 44.0.0-beta.5"}]}],"modified":"2026-09-29T17:26:51.547Z","provider":"cve","references":["https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj","https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d","https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d","https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397","https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2","https://github.com/electron/electron/releases/tag/v41.10.6","https://github.com/electron/electron/releases/tag/v42.9.2","https://github.com/electron/electron/releases/tag/v43.4.1","https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102675","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:25:31.410322Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:26:51.547Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T16:54:29.218Z"}}},"related_cves":[{"value":"CVE-2026-102675","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":3865,"advisory_id":"63903d2f-7346-4475-8d30-d68d352c5802","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102674","source_published_at":"2026-09-29T16:51:26.963+00:00","published_at":"2026-10-24T21:42:35.18125+00:00","extraction_method":"structured","technologies":["core-cve","electron"],"cve_ids":["CVE-2026-102674"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions","summary":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox. Applications that deny such popups with setWindowOpenHandler are not affected. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.","evidence":"cve:CVE-2026-102674","products":[{"name":{"value":"electron","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102674","aliases":["CVE-2026-102674"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"electron","product":"electron","versions":[{"status":"affected","version":"< 41.10.6"},{"status":"affected","version":">= 42.0.0-alpha.1, < 42.9.2"},{"status":"affected","version":">= 43.0.0-alpha.1, < 43.4.1"},{"status":"affected","version":">= 44.0.0-alpha.1, < 44.0.0-beta.5"}]}],"modified":"2026-09-29T17:20:35.969Z","provider":"cve","references":["https://github.com/electron/electron/security/advisories/GHSA-gr2m-v5gq-v685","https://github.com/electron/electron/commit/29fc130569f970e91e355383821a4af0f25724a2","https://github.com/electron/electron/commit/3ecf3e74f4be6e2360644679b0b4698742be0e1d","https://github.com/electron/electron/commit/6594d5a5b074cf501da084dc7908d3df0d68a886","https://github.com/electron/electron/commit/e9c4d3cbe912e18d7c63af78e63e98ae7a48cd3a","https://github.com/electron/electron/releases/tag/v41.10.6","https://github.com/electron/electron/releases/tag/v42.9.2","https://github.com/electron/electron/releases/tag/v43.4.1","https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T17:20:28.745285Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T17:20:35.969Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T16:51:26.963Z"}}},"related_cves":[{"value":"CVE-2026-102674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":20786,"next_before":3865}