Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-113800 EUVD-2026-107347GHSA-fw47-9c62-h3vw

Electron: HID and USB permission checks can be attributed to the wrong origin

Published Oct 21, 2026 · Updated Oct 23, 2026 · Assigned by GitHub_M

Vendor: electron Product: electron Package: electron Ecosystem: npm

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.

Affected products

VendorProductAffectedFixed
electron electron < 42.11.3, >= 43.0.0-alpha.1, < 43.7.0, >= 44.0.0-alpha.1, < 44.3.0, >= 45.0.0-alpha.1, < 45.0.0-alpha.5 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5 45.0.0-alpha.5 GHSA-fw47-9c62-h3vw
npm electron >= 44.0.0-alpha.1, < 44.3.0 44.3.0 GHSA-fw47-9c62-h3vw
npm electron >= 43.0.0-alpha.1, < 43.7.0 43.7.0 GHSA-fw47-9c62-h3vw
npm electron < 42.11.3 42.11.3 GHSA-fw47-9c62-h3vw

References