Electron up to 42.11.2/43.6.x/44.2.x/45.0.0-alpha.4 session.setPermissionRequestHandler permission

Summaryinfo

A vulnerability was found in Electron up to 42.11.2/43.6.x/44.2.x/45.0.0-alpha.4. It has been rated as critical. The impacted element is the function session.setPermissionRequestHandler. Performing a manipulation results in permission. This vulnerability was named CVE-2026-114121. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Electron up to 42.11.2/43.6.x/44.2.x/45.0.0-alpha.4. This affects the function session.setPermissionRequestHandler. The manipulation with an unknown input leads to a permission vulnerability. CWE is classifying the issue as CWE-275. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document other than the one that initiated them, causing the requestingUrl passed to session.setPermissionRequestHandler to identify trusted content for a launch requested by untrusted content. An application that grants openExternal based on the requesting origin and allows untrusted content to open or navigate windows could therefore allow that content to launch an OS-registered external application. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-114121 since 10/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading to version 42.11.3, 43.7.0, 44.3.0 or 45.0.0-alpha.5 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Electron

Version

• 42.11.0
• 42.11.1
• 42.11.2
• 43.0
• 43.1
• 43.2
• 43.3
• 43.4
• 43.5
• 43.6
• 44.0
• 44.1
• 44.2
• 45.0.0-alpha.0
• 45.0.0-alpha.1
• 45.0.0-alpha.2
• 45.0.0-alpha.3
• 45.0.0-alpha.4

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion