Electron up to 38.8.5/39.8.0/40.8.0/40.x setPermissionRequestHandler origin origin validation

Summaryinfo

A vulnerability marked as critical has been reported in Electron up to 38.8.5/39.8.0/40.8.0/40.x. Affected is the function setPermissionRequestHandler. Performing a manipulation of the argument origin results in origin validation. This vulnerability was named CVE-2026-34777. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Electron up to 38.8.5/39.8.0/40.8.0/40.x. This affects the function setPermissionRequestHandler. The manipulation of the argument origin with an unknown input leads to a origin validation vulnerability. CWE is classifying the issue as CWE-346. The product does not properly verify that the source of data or communication is valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content. The correct requesting URL remains available via details.requestingUrl. Apps that already check details.requestingUrl are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-34777 since 03/30/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 38.8.6, 39.8.1, 40.8.1 or 41.0.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Electron

Version

• 38.8.0
• 38.8.1
• 38.8.2
• 38.8.3
• 38.8.4
• 38.8.5
• 39.0
• 39.1
• 39.2
• 39.3
• 39.4
• 39.5
• 39.6
• 39.7
• 39.8.0
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7
• 40.8.0
• 40.x

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion