Live › vulnerability › CVE-2026-113798
Go to dashboardElectron mis-attributes pointer lock permission requests from some cross-origin iframes to the top-level page's origin and main-frame flag. An embedded untrusted frame can be granted pointer lock under the top-level page's identity by apps that decide permissions by origin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| electron | npm | >= 45.0.0-alpha.1, < 45.0.0-alpha.13 | 45.0.0-alpha.13 |
| electron | npm | >= 44.0.0-alpha.1, < 44.5.0 | 44.5.0 |
| electron | npm | >= 43.0.0-alpha.1, < 43.7.6 | 43.7.6 |
| electron | npm | < 42.11.9 | 42.11.9 |
s session.setPermissionRequestHandler grants pointerLock' based on requestingUrl or isMainFrame, and whether your pages embed untrusted iframesnpm ls electron45.0.0-alpha.13, 44.5.0, 43.7.6, or 42.11.9 (match your major line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.
Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not embed untrusted content, or that deny pointerLock for it, are not affected.
Deny the pointerLock permission for web contents that embed untrusted frames.
45.0.0-alpha.1344.5.043.7.642.11.9If you have any questions or comments about this advisory, email us at [email protected]
This page as .md · .json · in your agent: get_signal("CVE-2026-113798")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.