CVE-2026-4643 Calling window.close() from server-side content causes crash in the Mattermost Desktop App

Q: Is CVE-2026-4643 being exploited?

There is no known exploitation of CVE-2026-4643 in the wild and no public exploit code.

Q: How do I fix CVE-2026-4643?

No fix has been published for CVE-2026-4643 yet. Limit exposure of the affected software until one is available.

Low 3.5 Published 18 May 2026 Updated 18 May 2026

A malicious server or plugin can crash the Mattermost Desktop App by invoking window.close() in the renderer context, causing a client-side denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-4643?

CVE-2026-4643 is a low-severity denial of service vulnerability in Mattermost, published on 18 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking {{window.close()}} in the renderer context, leading to a denial of service condition at the client level. Mattermost Advisory ID: MMSA-2026-00633

Weakness: CWE-754

Which versions are affected by CVE-2026-4643?

It affects 1 product.

Products include Mattermost Mattermost Desktop.

How do I fix CVE-2026-4643?

No fix has been published for CVE-2026-4643 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-4643 being exploited?

There is no known exploitation of CVE-2026-4643 in the wild and no public exploit code.

Sources

Also known as GHSA-mf43-g8vp-9q4m.