GHSA-2p8c-gr87-2676 Electron: SameSite cookie restrictions are not applied to windows opened from links

• npm electron: >= 45.0.0-alpha.1, < 45.0.0-alpha.6 → fixed in 45.0.0-alpha.6 • npm electron: >= 44.0.0-alpha.1, < 44.3.0 → fixed in 44.3.0 • npm electron: >= 43.0.0-alpha.1, < 43.7.0 → fixed in 43.7.0 • npm electron: < 42.11.3 → fixed in 42.11.3

Impact Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: `SameSite=Strict` cookies were sent and `Sec-Fetch-Site` did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence. Apps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with `setWindowOpenHandler` are not affected. Workarounds Return `{ action: 'deny' }` from `setWindowOpenHandler` for windows opened by untrusted content. Fixed Versions • `45.0.0-alpha.6` • `44.3.0` • `43.7.0` • `42.11.3` For more information If you have any questions or comments about this advisory, email us at [email protected]