CVE-2026-102676 is a high severity (CVSS 8.3) flaw in Electron. A webview guest could enable Node.js integration for its Web Workers even when the embedder had it disabled. The fixed releases are 41.10.6, 42.9.2, 43.4.1 and 44.0.0-beta.5. Apps that do not use the webview tag, or keep the embedder sandboxed, are not affected.
What's affected
Per the record, these Electron releases are fixed: 41.10.6, 42.9.2, 43.4.1 and 44.0.0-beta.5. Earlier releases in those lines are affected.
You are only exposed if two things hold. Your app enables the webview tag, and the unsandboxed embedder has Node.js integration disabled yet the guest content can still enable it for workers. The record says apps that do not enable the webview tag, or that keep the embedder sandboxed, are not affected.
How to check if you're exposed
Check your Electron version and your webview usage:
npm ls electron
grep -rn "webviewTag" .
grep -rn "sandbox" --include=*.js --include=*.ts src/
Look at your BrowserWindow options. If webviewTag is true, note whether the window is sandboxed and which content the webviews load. Content from outside your control raises the stakes.
What to do now
- Upgrade Electron to the fixed release for your line: 41.10.6, 42.9.2, 43.4.1, or 44.0.0-beta.5 if you are on that beta line.
- If you do not need the webview tag, leave it disabled.
- Keep windows sandboxed where you can, and avoid loading untrusted content into webviews.
- Ship a new build to users, since desktop apps carry their own copy of Electron.
- Add an Electron version check to CI so an old runtime cannot ship by accident.
Why it matters
Desktop apps built on Electron bundle the framework. A fix in Electron does nothing for you until you rebuild and ship the app. That is why a framework issue like this reaches users late.
The weaknesses are CWE-1188 (insecure default initialization of a resource) and CWE-269 (improper privilege management). The webview guest ended up with a worker that had more privilege than the embedder had granted. In an Electron app, Node access means access to the file system and processes on the user's machine.
The vector needs user interaction, and the attack complexity is high. The record does not report exploitation in the wild, and the KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to act if my app never uses webview?
The record says apps that do not enable the webview tag are not affected. Still plan to take the next Electron update, as it carries other fixes.
Sources
Last reviewed: 19 October 2026.
