{"id":"CVE-2026-113798","kind":"vulnerability","aliases":["CVE-2026-113798","GHSA-x562-297c-g43g"],"related":[],"title":"Electron: Pointer lock permission requests can be attributed to the wrong frame","description":"### Impact\nFor `pointerLock` permission requests made from some cross-origin iframes, `session.setPermissionRequestHandler()` was given the top-level frame's `requestingUrl` and `isMainFrame` instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.\n\nApps are only affected if they embed untrusted content in iframes and decide `pointerLock` requests by origin in `setPermissionRequestHandler`. Apps that do not embed untrusted content, or that deny `pointerLock` for it, are not affected.\n\n### Workarounds\nDeny the `pointerLock` permission for web contents that embed untrusted frames.\n\n### Fixed Versions\n* `45.0.0-alpha.13`\n* `44.5.0`\n* `43.7.6`\n* `42.11.9`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","summary":"Electron mis-attributes pointer lock permission requests from some cross-origin iframes to the top-level page's origin and main-frame flag. An embedded untrusted frame can be granted pointer lock under the top-level page's identity by apps that decide permissions by origin.","severity":"medium","cvss":5.400000095367432,"epss":0.0020699999295175076,"exploited":false,"exploited_at":null,"products":[{"name":"electron","fixed":["45.0.0-alpha.13"],"affected":">= 45.0.0-alpha.1, < 45.0.0-alpha.13","ecosystem":"npm"},{"name":"electron","fixed":["44.5.0"],"affected":">= 44.0.0-alpha.1, < 44.5.0","ecosystem":"npm"},{"name":"electron","fixed":["43.7.6"],"affected":">= 43.0.0-alpha.1, < 43.7.6","ecosystem":"npm"},{"name":"electron","fixed":["42.11.9"],"affected":"< 42.11.9","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-346","desktop-apps","electron","javascript","package"],"not_affected_if":["no-permission-handler-by-origin","no-untrusted-iframes","pointerlock-denied"],"how_to_check":"Check whether your app's session.setPermissionRequestHandler grants 'pointerLock' based on requestingUrl or isMainFrame, and whether your pages embed untrusted iframes.\nRun: npm ls electron","fix":"Upgrade electron to 45.0.0-alpha.13, 44.5.0, 43.7.6, or 42.11.9 (match your major line).\nWorkaround until upgraded: deny the pointerLock permission for web contents that embed untrusted frames.","status":"open","published_at":"2026-10-21T17:18:24+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T19:58:12+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T19:58:12Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade electron to 45.0.0-alpha.13, 44.5.0, 43.7.6, or 42.11.9 (match your major line).\nWorkaround until upgraded: deny the pointerLock permission for web contents that embed untrusted frames.","summary":"Electron mis-attributes pointer lock permission requests from some cross-origin iframes to the top-level page's origin and main-frame flag. An embedded untrusted frame can be granted pointer lock under the top-level page's identity by apps that decide permissions by origin.","category":"package","who_cares":["electron","desktop-apps","javascript"],"confidence":0.85,"analyst_note":"","how_to_check":"Check whether your app's session.setPermissionRequestHandler grants 'pointerLock' based on requestingUrl or isMainFrame, and whether your pages embed untrusted iframes.\nRun: npm ls electron\nunknown","needs_analyst":false,"not_affected_if":["no-untrusted-iframes","pointerlock-denied","no-permission-handler-by-origin"],"severity_if_unknown":"medium"},"cost_usd":0.000434,"input_tokens":2427,"output_tokens":382,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113798':15A,23A '-2026':14A,22A '-346':29B '297c':19A '42.11.9':194C '43.7.6':193C '44.5.0':192C '45.0.0':190C 'advisori':207C 'affect':144C,175C 'alpha.13':191C 'app':32B,81B,117C,141C,160C 'attribut':8A,39B 'base':122C 'comment':204C 'content':132C,149C,166C,183C 'could':127C 'cross':47B,96C 'cross-origin':46B,95C 'cve':13A,21A 'cwe':28B 'decid':83B,153C 'deni':169C,177C 'desktop':31B 'desktop-app':30B 'electron':1A,24A,25A,26A,27A,33B,36B 'email':208C 'emb':147C,164C,185C 'embed':64B,131C 'fix':188C 'flag':62B 'frame':12A,61B,66B,106C,115C,187C 'g43g':20A 'ghsa':17A 'ghsa-x562-297c-g43g':16A 'given':101C 'grant':69B,119C,128C 'ident':79B,140C 'ifram':49B,98C,151C 'impact':87C 'inform':197C 'instead':111C 'ismainfram':110C 'javascript':34B 'level':54B,76B,105C,137C 'lock':3A,41B,71B,121C 'made':92C 'mailto':212C 'main':60B 'main-fram':59B 'mis':38B 'mis-attribut':37B 'origin':48B,57B,86B,97C,126C,157C 'packag':35B 'page':55B,77B,138C 'permiss':4A,42B,84B,90C,180C 'pointer':2A,40B,70B,120C 'pointerlock':89C,154C,170C,179C 'question':202C 'request':5A,43B,91C,114C,125C,155C 'requestingurl':108C 'security@electronjs.org':211C,213C 'session.setpermissionrequesthandler':99C 'setpermissionrequesthandl':159C 'top':53B,75B,104C,136C 'top-level':52B,74B,103C,135C 'untrust':65B,148C,165C,186C 'us':209C 'version':189C 'web':182C 'workaround':176C 'wrong':11A 'x562':18A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-x562-297c-g43g","url":"https://github.com/advisories/GHSA-x562-297c-g43g","severity":"medium","published_at":"2026-10-22T16:47:15+00:00","modified_at":"2026-10-22T16:47:18+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-113798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113798","severity":null,"published_at":"2026-10-21T17:18:24+00:00","modified_at":"2026-10-22T17:29:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}