## Electron: openExternal permission requests can be attributed to the wrong origin

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs, electron
- CVE: CVE-2026-114121
- 公開日時: 2026-10-22T16:43:59.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-997q-gvvc-jwmx)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-997q-gvvc-jwmx

影響: npm:electron < 42.11.3 → 42.11.3, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5 → 45.0.0-alpha.5
Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application. Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose…