CVE-2026-113800 in Electron
Summary
by MITRE • 10/22/2026
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
Electron serves as a widely adopted framework for developing cross-platform desktop applications by leveraging web technologies such as JavaScript, HTML, and CSS. This architecture allows developers to build native-like experiences using standard web development practices, but it also introduces specific security considerations related to how the underlying Chromium engine handles permissions and frame isolation. In versions of Electron prior to 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, a critical flaw existed in the handling of hardware device permission checks for HID (Human Interface Device) and USB interfaces when these requests originated from within an iframe context. The vulnerability stems from incorrect origin attribution during the permission validation process, which undermines the security model designed to isolate content from different origins.
The technical core of this vulnerability lies in how Electron's internal handler, setPermissionCheckHandler, processes permission requests for sensitive hardware APIs. When a cross-origin untrusted iframe attempts to access HID or USB devices, the framework erroneously passes the origin and details of the top-level frame rather than the actual requesting frame's context to the permission check logic. This misattribution means that if an application has configured its security policies to grant device access based on the origin of the main page, any embedded iframe can exploit this flaw to bypass those restrictions. The handler fails to distinguish between the parent window and the child frame, effectively treating all requests as if they originated from the trusted top-level context.
This architectural oversight results in a significant breach of isolation principles, allowing an untrusted cross-origin iframe to gain access to hardware devices that were intended only for the primary application page. For developers who delegate HID or USB permissions based on origin-based logic, this flaw creates a direct path for privilege escalation within the application's context. An attacker controlling content loaded into such an iframe could potentially interact with connected peripherals, read sensitive data from input devices, or inject commands to hardware components that should remain inaccessible to embedded web content. This scenario is particularly dangerous in applications that load third-party widgets or advertisements via iframes, as these external sources are inherently less trusted than the application's own codebase.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control and CWE-1004 Sensitive Information Without Proper Consumption Handling, as it involves unauthorized access to resources due to flawed permission checks. In terms of the MITRE ATT&CK framework for enterprise security, this vulnerability facilitates lateral movement within a single application environment by allowing an attacker-controlled script to escalate privileges from a sandboxed iframe context to full hardware interaction capabilities. It represents a failure in enforcing strict origin boundaries, which is fundamental to web security models like the Same-Origin Policy.
To mitigate this risk, developers must upgrade their Electron dependencies to version 42.11.3 or later for the 42.x branch, 43.7.0 or later for the 43.x branch, 44.3.0 or later for the 44.x branch, and 45.0.0-alpha.5 or later for development builds. These releases contain patches that correctly attribute permission requests to their originating frame, ensuring that origin-based access controls are enforced accurately regardless of whether the request comes from a top-level window or an embedded iframe. Additionally, applications should review their use of setPermissionCheckHandler and ensure that any custom logic strictly validates the actual requesting context rather than relying on potentially misleading parent origins. Implementing strict Content Security Policies to limit iframe capabilities can further reduce the attack surface by preventing untrusted content from making hardware-related requests in the first place.