Yarn Audit: new or newly blocking advisories on main (011ddf6dda)

**5** new or newly blocking advisories detected on push to `main` (0 release-blocking).

CI run: https://github.com/MetaMask/metamask-extension/actions/runs/31026449337

## Informational (dev-only or low severity)

- **electron** (high, dev-only) — Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
https://github.com/advisories/GHSA-9f4c-93c8-jc8g
- **electron** (moderate, dev-only) — Electron: Sandboxed iframes can launch external protocol handlers
https://github.com/advisories/GHSA-p2rr-rvmm-c5fp
- **electron** (moderate, dev-only) — Electron: DevTools embedder handler executes arbitrary files via shell open
https://github.com/advisories/GHSA-f2r8-jv7c-xqmp
- **electron** (moderate, dev-only) — Electron: contextBridge object copy honors prototype setters
https://github.com/advisories/GHSA-ff2p-hmqr-hxm4
- **electron** (moderate, dev-only) — Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
https://github.com/advisories/GHSA-4f78-qhmw-8j8m

Native audit tree

```
├─ electron
│ ├─ ID: 1136607
│ ├─ Issue: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
│ ├─ URL: https://github.com/advisories/GHSA-9f4c-93c8-jc8g
│ ├─ Severity: high
│ ├─ Vulnerable Versions: <39.8.10
│ │
│ ├─ Tree Versions
│ │ └─ 23.3.0
│ │
│ └─ Dependents
│ └─ react-devtools@npm:6.1.5
│

├─ electron
│ ├─ ID: 1136634
│ ├─ Issue: Electron: Sandboxed iframes can launch external protocol handlers
│ ├─ URL: https://github.com/advisories/GHSA-p2rr-rvmm-c5fp
│ ├─ Severity: moderate
│ ├─ Vulnerable Versions: <39.8.8
│ │
│ ├─ Tree Versions
│ │ └─ 23.3.0
│ │
│ └─ Dependents
│ └─ react-devtools@npm:6.1.5
│

├─ electron
│ ├─ ID: 1136647
│ ├─ Issue: Electron: DevTools embedder handler executes arbitrary files via shell open
│ ├─ URL: https://github.com/advisories/GHSA-f2r8-jv7c-xqmp
│ ├─ Severity: moderate
│ ├─ Vulnerable Versions: <39.8.9
│ │
│ ├─ Tree Versions
│ │ └─ 23.3.0
│ │
│ └─ Dependents
│ └─ react-devtools@npm:6.1.5
│

├─ electron
│ ├─ ID: 1136651
│ ├─ Issue: Electron: contextBridge object copy honors prototype setters
│ ├─ URL: https://github.com/advisories/GHSA-ff2p-hmqr-hxm4
│ ├─ Severity: moderate
│ ├─ Vulnerable Versions: <39.8.9
│ │
│ ├─ Tree Versions
│ │ └─ 23.3.0
│ │
│ └─ Dependents
│ └─ react-devtools@npm:6.1.5
│

├─ electron
│ ├─ ID: 1136659
│ ├─ Issue: Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter
│ ├─ URL: https://github.com/advisories/GHSA-4f78-qhmw-8j8m
│ ├─ Severity: moderate
│ ├─ Vulnerable Versions: <39.8.7
│ │
│ ├─ Tree Versions
│ │ └─ 23.3.0
│ │
│ └─ Dependents
│ └─ react-devtools@npm:6.1.5
│
```

Start with the linked CI run and review the native audit tree for Electron 23.3.0 and its five advisories. Determine the required dependency change and verify completion by rerunning the Yarn audit so these advisories are no longer reported.

Written by the indexing model from the issue text.