CVE-2026-113798: Electron: Pointer lock permission requests can be attributed to the wrong frame
For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame’s requestingUrl and isMainFrame instead of the requesting frame’s. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page’s identity.
Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not embed untrusted content, or that deny pointerLock for it, are not affected.
References
- github.com/advisories/GHSA-x562-297c-g43g
- github.com/electron/electron/commit/076c7496791a45968cf8d9e76e9657bc161ea979
- github.com/electron/electron/commit/0b680cfa1ffa70a50282da53efde37a210d5223b
- github.com/electron/electron/commit/1755ee598697356959219beefee1e139bc3f8207
- github.com/electron/electron/commit/4073e9f4712f61e6b8abd5548673cc7638f6c1a1
- github.com/electron/electron/commit/a48e6eaaafa85b6fc40f7431ceec4fd6ef4bb899
- github.com/electron/electron/pull/54432
- github.com/electron/electron/pull/54463
- github.com/electron/electron/pull/54464
- github.com/electron/electron/pull/54465
- github.com/electron/electron/pull/54466
- github.com/electron/electron/releases/tag/v42.11.9
- github.com/electron/electron/releases/tag/v43.7.6
- github.com/electron/electron/releases/tag/v44.5.0
- github.com/electron/electron/releases/tag/v45.0.0-alpha.13
- github.com/electron/electron/security/advisories/GHSA-x562-297c-g43g
- nvd.nist.gov/vuln/detail/CVE-2026-113798
Code Behaviors & Features
Detect and mitigate CVE-2026-113798 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →