Electron: SameSite cookie restrictions are not applied to windows opened from links

影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.6 → 45.0.0-alpha.6, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron < 42.11.3 → 42.11.3

Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: SameSite=Strict cookies were sent and Sec-Fetch-Site did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence. Apps are only affected if they load untrusted content and allow it to open ne…

在 GitHub Advisory Database 阅读

2026/10/23 01:47，GitHub Advisory Database 发布了“Electron: SameSite cookie restrictions are not applied to windows opened from links”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js、Electron。CVE：CVE-2026-113796。