CVE-2026-113800: Electron: HID and USB permission checks can be attributed to the wrong origin
For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame’s origin and details instead of the requesting frame’s. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.
You’re only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow="hid" or allow="usb". Apps that don’t delegate those features to untrusted iframes are not affected.
References
- github.com/advisories/GHSA-fw47-9c62-h3vw
- github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a
- github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742
- github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0
- github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd
- github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0
- github.com/electron/electron/pull/53656
- github.com/electron/electron/pull/53679
- github.com/electron/electron/pull/53688
- github.com/electron/electron/pull/53689
- github.com/electron/electron/pull/53736
- github.com/electron/electron/releases/tag/v42.11.3
- github.com/electron/electron/releases/tag/v43.7.0
- github.com/electron/electron/releases/tag/v44.3.0
- github.com/electron/electron/releases/tag/v45.0.0-alpha.5
- github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw
- nvd.nist.gov/vuln/detail/CVE-2026-113800
Code Behaviors & Features
Detect and mitigate CVE-2026-113800 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →