All vulnerabilities
CVE-2026-113800GHSA-fw47-9c62-h3vw

Electron: HID and USB permission checks can be attributed to the wrong origin

electron electronnpmRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in45.0.0-alpha.5Also 44.3.0, 43.7.0 and 1 moreGitHub
Published21 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 45.0.0-alpha.5electron, npmGitHubnpm install electron@45.0.0-alpha.5
  • 44.3.0electron, npmGitHubnpm install electron@44.3.0
  • 43.7.0electron, npmGitHubnpm install electron@43.7.0
  • 42.11.3electron, npmGitHubnpm install electron@42.11.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.

You're only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow="hid" or allow="usb". Apps that don't delegate those features to untrusted iframes are not affected.

Workarounds

Don't add allow="hid" / allow="usb" to untrusted iframes, or make the decision in your select-hid-device / select-usb-device handler using details.frame.

Fixed Versions

  • 45.0.0-alpha.5
  • 44.3.0
  • 43.7.0
  • 42.11.3

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Text from GitHub Advisory Database

Affected versions 12

  • electron, npm>= 45.0.0-alpha.1, < 45.0.0-alpha.5GitHub
  • electron, npm>= 44.0.0-alpha.1, < 44.3.0GitHub
  • electron, npm>= 43.0.0-alpha.1, < 43.7.0GitHub
  • electron, npm< 42.11.3GitHub
  • electronaffected: < 42.11.3CVE List
  • electronaffected: >= 43.0.0-alpha.1, < 43.7.0CVE List
  • electronaffected: >= 44.0.0-alpha.1, < 44.3.0CVE List
  • electronaffected: >= 45.0.0-alpha.1, < 45.0.0-alpha.5CVE List
  • electron, npmfrom 45.0.0-alpha.1, fixed in 45.0.0-alpha.5OSV
  • electron, npmfrom 44.0.0-alpha.1, fixed in 44.3.0OSV
  • electron, npmfrom 43.0.0-alpha.1, fixed in 43.7.0OSV
  • electron, npmfrom first release, fixed in 42.11.3OSV

References 16