Live › vulnerability › CVE-2026-113800
Go to dashboardElectron's session.setPermissionCheckHandler reported the top-level page's origin and details for hid and usb permission checks made from iframes, instead of the iframe's own. An embedded cross-origin frame that was delegated hid or usb can therefore be granted access meant for the top-level page by origin-based logic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| electron | npm | >= 45.0.0-alpha.1, < 45.0.0-alpha.5 | 45.0.0-alpha.5 |
| electron | npm | >= 44.0.0-alpha.1, < 44.3.0 | 44.3.0 |
| electron | npm | >= 43.0.0-alpha.1, < 43.7.0 | 43.7.0 |
| electron | npm | < 42.11.3 | 42.11.3 |
hid or usb based on origin45.0.0-alpha.5, 44.3.0, 43.7.0, or 42.11.3, matching your release lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.
You're only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow="hid" or allow="usb". Apps that don't delegate those features to untrusted iframes are not affected.
Don't add allow="hid" / allow="usb" to untrusted iframes, or make the decision in your select-hid-device / select-usb-device handler using details.frame.
45.0.0-alpha.544.3.043.7.042.11.3If you have any questions or comments about this advisory, email us at [email protected]
This page as .md · .json · in your agent: get_signal("CVE-2026-113800")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.