CVE-2026-113798

Undergoing Analysis Undergoing Analysis - In Progress

Pointer Lock Permission Bypass in Electron Framework

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded content are not affected. This issue is fixed in versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113798

EUVD

EUVD-2026-107374

Affected Vendors & Products

Vendor	Product	Version / Range
electron	electron	< 42.11.9
electron	electron	>= 43.0.0-alpha.1, < 43.7.6
electron	electron	>= 44.0.0-alpha.1, < 44.5.0
electron	electron	>= 45.0.0-alpha.1, < 45.0.0-alpha.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability in Electron involves incorrect handling of pointer lock permission requests from cross-origin iframes. The permission request handler mistakenly attributes requests to the parent frame instead of the actual requesting iframe. This could allow untrusted embedded content to gain pointer lock permissions under the top-level page's identity, potentially leading to unauthorized access or control over user input.

Detection Guidance

Detecting this vulnerability requires checking if your Electron application is running a vulnerable version. Use commands like 'npm list electron' or 'electron --version' to check the installed version. Compare it against versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13 or later.

Impact Analysis

If you use an Electron application that embeds untrusted iframe content and grants pointer lock based on the requesting origin, this vulnerability could allow the embedded content to bypass permission checks. This might lead to unauthorized access to pointer lock functionality, potentially affecting user input control or enabling malicious actions under the application's identity.

Mitigation Strategies

Immediately update Electron to a patched version (42.11.9, 43.7.6, 44.5.0, or 45.0.0-alpha.13). If updating is not possible, implement a workaround by denying pointer lock permissions for untrusted iframe content in your application's permission request handler.

Hi! I’m here to help you understand CVE-2026-113798. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...