Electron: HID and USB permission checks can be attributed to the wrong origin (CVE-2026-113800)
Description
Electron versions prior to 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5 have a vulnerability where HID and USB permission checks made from iframes can be attributed to the wrong origin. This occurs because the permission check handler receives the top-level frame's origin instead of the requesting iframe's origin, potentially allowing embedded frames to gain access intended only for the top-level page. The issue affects apps using origin-based logic in setPermissionCheckHandler for HID or USB permissions and embedding cross-origin iframes with these permissions allowed. The vulnerability has a medium severity with a CVSS score of 5.4 and has been fixed in the specified versions.
CVSS v3.1
Score 5.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-113800 in Electron involves incorrect attribution of HID and USB permission checks when made from iframes. Specifically, the session.setPermissionCheckHandler callback is provided with the top-level frame's origin and details rather than the requesting iframe's origin. This can cause applications that grant HID or USB permissions based on origin to mistakenly allow embedded cross-origin iframes access to these devices. The vulnerability only affects applications that use origin-based permission logic and allow untrusted iframes the 'hid' or 'usb' permissions. The issue is fixed in Electron versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
Potential Impact
Applications using Electron with origin-based permission checks for HID or USB devices and embedding cross-origin iframes with these permissions may inadvertently grant device access to untrusted frames. This could lead to unauthorized access to HID or USB devices from embedded content. The impact is limited to apps that delegate these permissions to untrusted iframes and use setPermissionCheckHandler with origin-based logic. The CVSS score of 5.4 reflects a medium severity with limited attack complexity and partial confidentiality and integrity impact.
Mitigation Recommendations
A fix is available in Electron versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5. Users should upgrade to these or later versions to resolve the issue. As a workaround, avoid adding 'allow="hid"' or 'allow="usb"' attributes to untrusted iframes, or implement permission decisions in the select-hid-device or select-usb-device handlers using the details.frame property to correctly identify the requesting frame.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fw47-9c62-h3vw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-113800"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ad91cab4d27ba8daafa91d3
Added to database: 10/21/2026, 20:12:27 UTC
Last enriched: 10/21/2026, 20:15:10 UTC
Last updated: 10/21/2026, 20:15:10 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.