Summary
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
Advisory details
Impact
A <webview> could enable Node.js integration in its Web Workers even when its embedder had Node.js integration disabled, giving guest content more privilege than the embedder allowed.
Apps are only affected if they enable the <webview> tag and the embedder is unsandboxed. Apps that do not use <webview>, or that keep the embedder sandboxed, are not affected.
Workarounds
Remove nodeIntegrationInWorker from the guest preferences in a will-attach-webview handler, or do not enable the <webview> tag when loading untrusted content.
Fixed Versions
44.0.0-beta.543.4.142.9.241.10.6
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
References
- https://github.com/advisories/GHSA-9qh4-3jw8-366w
- https://github.com/electron/electron/security/advisories/GHSA-9qh4-3jw8-366w
- https://github.com/electron/electron/commit/6462a2e1dc4e6adffd3b7d9b9be1474c45dcbbe2
- https://github.com/electron/electron/commit/9a675aef8822bae4088567822969f900b3a37671
- https://github.com/electron/electron/commit/b3ae0aab5cf81c2ed03d04df1ae8e69ecfab7886
- https://github.com/electron/electron/commit/cd34f335c8664613db5b6e61ae51e2e1846233ae
- https://github.com/electron/electron/releases/tag/v41.10.6
- https://github.com/electron/electron/releases/tag/v42.9.2
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-96627
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
- HIGHCVE-2026-95837
containerd CRI plugin: Checkpoint restore bypasses destination security context
- CRITICALCVE-2026-77524
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
- HIGHCVE-2026-85990
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
- MEDIUMGHSA-pjr3-86v4-5p7w
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
- HIGHCVE-2026-57458
Vikunja: Scoped API token can mint unrestricted OAuth session credentials