## Electron: SameSite cookie restrictions are not applied to windows opened from links

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs, electron
- CVE: CVE-2026-113796
- 公開日時: 2026-10-22T16:47:54.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-2p8c-gr87-2676)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-2p8c-gr87-2676

影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.6 → 45.0.0-alpha.6, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron < 42.11.3 → 42.11.3
Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: SameSite=Strict cookies were sent and Sec-Fetch-Site did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence. Apps are only affected if they load untrusted content and allow it to open ne…