Electron: SameSite cookie restrictions are not applied to windows opened from links
影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.6 → 45.0.0-alpha.6, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron < 42.11.3 → 42.11.3
Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: SameSite=Strict cookies were sent and Sec-Fetch-Site did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence. Apps are only affected if they load untrusted content and allow it to open ne…
Read on GitHub Advisory Database
| CVE | CVE-2026-113796 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/23/2026, 05:09 AM |
| Data | Markdown JSON |
On 10/23/2026, 01:47 AM, GitHub Advisory Database published "Electron: SameSite cookie restrictions are not applied to windows opened from links" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js, Electron. CVE: CVE-2026-113796.