CVE-2026-114121
Description
A flaw was found in Electron. Due to incorrect origin attribution when opening external protocol URLs (Uniform Resource Locators), requests initiated by untrusted content may be misidentified as originating from trusted documents. A remote attacker capable of navigating or loading untrusted web content can exploit this vulnerability to bypass permission checks and launch registered operating system applications without authorization.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires specific application configurations that evaluate external URI permissions based on origin while allowing untrusted content to navigate or spawn windows. Furthermore, the blast radius is limited to invoking registered external operating system handlers rather than enabling direct remote code execution. Red Hat Enterprise Linux does not provide Electron as a core system package, restricting exposure to third-party desktop or developer applications running on the system.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
