CVE-2026-113800

Undergoing Analysis Undergoing Analysis - In Progress

Permission Check Bypass in Electron Framework

Publication date: 2026-10-21

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113800

EUVD

EUVD-2026-107347

Affected Vendors & Products

Vendor	Product	Version / Range
electron	electron	< 42.11.3
electron	electron	>= 43.0.0-alpha.1, < 43.7.0
electron	electron	>= 44.0.0-alpha.1, < 44.3.0
electron	electron	>= 45.0.0-alpha.1, < 45.0.0-alpha.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability affects Electron applications using HID or USB device permissions. When a cross-origin iframe requests device access, the permission check incorrectly uses the top-level frame's origin instead of the iframe's origin. This allows the iframe to gain unauthorized device access intended for the main page.

Detection Guidance

This vulnerability is specific to Electron applications and cannot be directly detected via network or system commands. Instead, check if your Electron application uses versions prior to 42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5. Review application logs for permission-related errors or misconfigurations in HID/USB device access.

Impact Analysis

If you use an Electron app that embeds untrusted iframes with device access permissions, those iframes could gain unauthorized control over HID or USB devices. This might allow malicious code to interact with connected hardware like keyboards, mice, or other peripherals without your knowledge.

Mitigation Strategies

Update Electron to the latest patched versions (42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5) immediately. Review and restrict cross-origin iframe permissions in your Electron app to prevent unauthorized device access. Audit applications using Electron for HID/USB permissions and ensure origin-based logic is correctly implemented.

Hi! I’m here to help you understand CVE-2026-113800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...