CVE-2026-34765: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34765 is a window context scoping vulnerability in the Electron framework, titled "Named window.open targets not scoped to the opener's browsing context." When a renderer calls window.open() with a target name, Electron fails to correctly scope the named-window lookup to the opener's browsing context group, allowing a renderer to navigate a child window opened by a different, unrelated renderer if both use the same target name. Affected versions include all Electron releases before 39.8.5, 40.x before 40.8.5, 41.x before 41.1.0, and 42.0.0-alpha.1 through 42.0.0-alpha.4. The advisory was published on April 7, 2026, by the Electron security team. The GitHub Security Advisory assigns a CVSS v3.1 score of 6.0 (Moderate), while Feedly's aggregated data reflects a higher estimate of 8.8 (High) (GitHub Advisory).

The root cause is classified as CWE-668 (Exposure of Resource to Wrong Sphere): Electron's window.open() implementation performs named-window lookups across all browsing context groups rather than restricting the search to the opener's own group. When a second, lower-trust renderer calls window.open('url', 'targetName') using a target name that matches an existing child window created by a different renderer, Electron navigates that existing child window on behalf of the second renderer. The second renderer then inherits the webPreferences (e.g., privileged preload scripts) originally configured for that child window via setWindowOpenHandler's overrideBrowserWindowOptions. Exploitation requires the application to open multiple top-level windows with differing trust levels and to grant elevated webPreferences to child windows; apps using a single top-level window or not elevating child window privileges are not affected (GitHub Advisory).

A low-privileged renderer process can exploit window naming conflicts to gain access to privileged browsing contexts without user interaction, inheriting elevated webPreferences such as privileged preload scripts. In applications that additionally grant nodeIntegration: true or sandbox: false to child windows (contrary to Electron's security recommendations), this privilege escalation can lead to arbitrary code execution within the Electron application process. The confidentiality, integrity, and availability of the affected application are all at risk, with the potential for full application compromise in the worst-case configuration (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.051%, indicating a low probability of exploitation in the near term. The vulnerability was reported by researchers HO-9 and HanJeouk, and Nessus detection plugin 305568 has been published (Tenable).

1. Identify a target application: Find an Electron application that opens multiple top-level windows with differing trust levels and uses setWindowOpenHandler to grant child windows elevated webPreferences (e.g., a privileged preload script, nodeIntegration: true, or sandbox: false).
2. Determine the target window name: Identify or guess the named target string used by a privileged renderer when calling window.open('url', 'targetName') to create an elevated child window. This may be discoverable through application source code, developer tools, or behavioral observation.
3. Control a lower-trust renderer: Gain execution context in a lower-trust renderer within the same Electron application (e.g., by loading attacker-controlled content in a less-privileged window).
4. Trigger window name collision: From the lower-trust renderer, call window.open('attacker-controlled-url', 'targetName') using the same target name as the privileged child window. Electron's flawed lookup resolves the existing privileged child window instead of creating a new one.
5. Inherit elevated permissions: The attacker-controlled URL is loaded into the existing privileged child window, inheriting its webPreferences. If nodeIntegration: true or sandbox: false is set, the attacker gains access to Node.js APIs and can execute arbitrary code within the Electron process (GitHub Advisory).

• Logs: Electron application logs showing unexpected navigation events in child windows, particularly where the navigating renderer's origin does not match the child window's original opener.
• Process Behavior: Unexpected Node.js API calls or system-level operations (e.g., file system access, network connections) originating from renderer processes that should be sandboxed or low-trust.
• Network: Outbound connections from the Electron application to unexpected or attacker-controlled URLs that were loaded into privileged child windows.
• Application Behavior: Child windows loading content from origins inconsistent with the application's intended flow, or preload scripts executing in contexts where they were not expected.

Electron has released patched versions addressing this vulnerability: 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5. Upgrading to one of these versions is the primary recommended remediation (GitHub Advisory). As an interim workaround, deny window.open() in renderers that load untrusted content by returning { action: 'deny' } from setWindowOpenHandler, and avoid granting child windows more permissive webPreferences than their opener. Additionally, do not configure child windows with nodeIntegration: true or sandbox: false, in accordance with Electron's published security recommendations.

The advisory was published by Electron maintainer MarshallOfSound on April 6–7, 2026, crediting researchers HO-9 and HanJeouk for the discovery (GitHub Advisory). The vulnerability received standard coverage from vulnerability tracking services including CVEfeed, INCIBE-CERT, and Tenable's Nessus plugin database shortly after disclosure. Community reaction has been measured, consistent with the moderate severity rating and the narrow conditions required for exploitation.