CVE-2026-113798 in Electron
Summary
by MITRE • 10/21/2026
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded content are not affected. This issue is fixed in versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
Electron serves as a foundational framework for developing cross-platform desktop applications by leveraging web technologies such as JavaScript, HTML, and CSS. Within this architecture, the handling of permission requests is critical to maintaining application security boundaries, particularly when dealing with embedded content from different origins. A significant vulnerability was identified in Electron versions prior to 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13 regarding the handling of pointer lock permissions initiated by cross-origin iframes. This flaw represents a failure in origin isolation during permission validation processes, allowing for potential privilege escalation through context confusion.
The technical core of this vulnerability lies in how Electron's session.setPermissionRequestHandler() function processed requests originating from embedded frames. When an iframe hosted on a different domain than the top-level page requested pointer lock permissions, the handler incorrectly received metadata associated with the top-level frame rather than the actual requesting iframe. Specifically, the requestingUrl and isMainFrame values reflected the context of the main window instead of the subordinate frame. This misattribution means that security logic relying on these parameters to make access control decisions operates under false assumptions about the source of the request.
The operational impact of this flaw is substantial for applications that embed untrusted content from external sources. If an application grants pointer lock permissions based solely on the origin or identity provided by the permission handler, it may inadvertently grant such privileges to a malicious cross-origin iframe as if they were part of the trusted top-level page. This effectively bypasses same-origin policy expectations and allows potentially hostile scripts embedded within third-party content to capture mouse input exclusively without user awareness or proper authorization boundaries being enforced against that specific origin.
This vulnerability aligns with CWE-20, which describes Improper Input Validation, as the application fails to correctly validate the source of a security-critical request. Furthermore, it relates to ATT&CK technique T1536, Potential Double-Use of Resources, where an attacker might exploit the confusion between frame contexts to perform actions under the guise of a more privileged context. The issue is particularly dangerous in scenarios involving rich internet applications that integrate content from multiple domains without rigorous sandboxing or explicit permission checks for each embedded origin.
Mitigation requires immediate upgrading to patched versions of Electron, specifically 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13 or later. For applications that cannot immediately upgrade, developers should implement additional validation layers within their permission request handlers to explicitly verify the frame hierarchy and origin of each incoming request rather than relying on default metadata provided by the framework. Ensuring that pointer lock permissions are denied for untrusted embedded content remains a viable defensive strategy until patching is complete.