GHSA-hq2x-r82h-9wj4 Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

• npm electron: < 41.10.4 → fixed in 41.10.4 • npm electron: >= 42.0.0-alpha.1, < 42.5.2 → fixed in 42.5.2 • npm electron: >= 43.0.0-alpha.1, < 43.0.0 → fixed in 43.0.0

Impact Popups opened from a sandboxed iframe through a link (for example `target="_blank"` or a middle-click) did not inherit the iframe's HTML `sandbox` restrictions. Content that was meant to run sandboxed could open a popup with the embedding app's full origin, gaining access to that origin's cookies, storage, and same-origin scripting. Apps are only affected if they embed untrusted content in iframes sandboxed with `allow-scripts allow-popups`. Apps that do not embed untrusted content in sandboxed iframes are not affected. Workarounds Use `setWindowOpenHandler` on the parent `WebContents` to deny or constrain popups opened from sandboxed frames, or do not apply `allow-popups` to sandboxed iframes that render untrusted content. Fixed Versions • `43.0.0` • `42.5.2` • `41.10.4` For more information If you have any questions or comments about this advisory, email us at [email protected]