CVE-2026-113796
Description
A flaw was found in Electron. When opening links into a new window, Electron incorrectly classifies navigations as application-initiated rather than preserving the originating page as the initiator. A remote attacker who convinces an application to load untrusted web content that opens new windows could exploit this behavior to bypass SameSite cookie restrictions. Consequently, unauthorized credentialed requests could be sent to external websites, undermining Cross-Site Request Forgery (CSRF) protections.
Statement
Red Hat has rated this vulnerability as Moderate because exploitation requires a multi-step attack chain where an application loads untrusted content and user interaction triggers window creation, limiting the blast radius to cross-site request forgery against specific web endpoints. Electron is not distributed as part of Red Hat Enterprise Linux, reducing direct exposure across core platform deployments. Applications embedding the framework are susceptible only when configured to render untrusted third-party web content and permit external link navigation without restricting window creation.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
