Electron: SameSite cookie restrictions are not applied to windows opened from links
影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.6 → 45.0.0-alpha.6, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron < 42.11.3 → 42.11.3
Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: SameSite=Strict cookies were sent and Sec-Fetch-Site did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence. Apps are only affected if they load untrusted content and allow it to open ne…
| CVE | CVE-2026-113796 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 23. 오전 05:09 |
| 데이터 | Markdown JSON |
2026. 10. 23. 오전 01:47, GitHub Advisory Database에서 "Electron: SameSite cookie restrictions are not applied to windows opened from links"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js, Electron. CVE: CVE-2026-113796.