{"id":"ghsa-ghsa-2p8c-gr87-2676","seq":309556,"kind":"advisory","title":"Electron: SameSite cookie restrictions are not applied to windows opened from links","url":"https://github.com/advisories/GHSA-2p8c-gr87-2676","permalink":"https://vulnpulse.app/items/ghsa-ghsa-2p8c-gr87-2676","summary":"影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.6 → 45.0.0-alpha.6, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron < 42.11.3 → 42.11.3\nPages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: SameSite=Strict cookies were sent and Sec-Fetch-Site did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence. Apps are only affected if they load untrusted content and allow it to open ne…","severity":"medium","techs":["nodejs","electron"],"cves":["CVE-2026-113796"],"tags":["GHSA-2p8c-gr87-2676","electron","electron","electron","electron"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:47:54.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}