https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T18:19:03.140299+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-42700 EUVD-2026-42700 2026-10-09T18:19:03.143627+00:00 EUVD-2026-42700 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15174 fkie_cve-2020-15174 2026-10-09T18:19:03.143670+00:00

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.

 https://cve.radiocsirt.org/vuln/ghsa-2q4g-w47c-4674 GHSA-2q4g-w47c-4674 — Unpreventable top-level navigation 2026-10-09T18:19:03.143708+00:00

Affected: npm: electron

### Impact The `will-navigate` event that apps use to prevent navigations to unexpected destinations [as per our security recommendations](https://www.electronjs.org/docs/tutorial/security) can be bypassed when a sub-frame performs a top-frame navigation across sites.

### Patches

* `11.0.0-beta.1` * `10.0.1` * `9.3.0` * `8.5.1`

### Workarounds Sandbox all your iframes using the [`sandbox` attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox). This will prevent them creating top-frame navigations and is good practice anyway.

### For more information If you have any questions or comments about this advisory:

* Email us at security@electronjs.org

 https://cve.radiocsirt.org/vuln/gsd-2020-15174 gsd-2020-15174 2026-10-09T18:19:03.143742+00:00 gsd-2020-15174