Electron: openExternal permission requests can be attributed to the wrong origin

影響: npm:electron < 42.11.3 → 42.11.3, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5 → 45.0.0-alpha.5

Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application. Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose…

在 GitHub Advisory Database 阅读

2026/10/23 01:43，GitHub Advisory Database 发布了“Electron: openExternal permission requests can be attributed to the wrong origin”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js、Electron。CVE：CVE-2026-114121。