CVE-2026-113796

### Impact Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than the page that contained the link, so the request was treated as same-site: `SameSite=Strict` cookies were sent and `Sec-Fetch-Site` did not identify the initiating page. Content shown in the app could use this to make a credentialed top-level request to another site that relies on SameSite cookies as a CSRF defence. Apps are only affected if they load untrusted content and allow it to open new windows. Apps that deny new windows from untrusted content with `setWindowOpenHandler` are not affected. ### Workarounds Return `{ action: 'deny' }` from `setWindowOpenHandler` for windows opened by untrusted content. ### Fixed Versions * `45.0.0-alpha.6` * `44.3.0` * `43.7.0` * `42.11.3` ### For more information If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected])