In Electron, for serial-port and media (camera/microphone) permission checks initiated from an iframe, the requestingOrigin parameter passed to session.setPermissionCheckHandler was incorrectly set to the top-level frame's origin rather than the origin of the requesting iframe. This flaw could allow origin-based permission handlers to mistakenly grant device access to cross-origin iframes that should not have it. The vulnerability only affects applications that use setPermissionCheckHandler with origin-based logic and embed cross-origin iframes with delegated device permissions. Applications that base permission decisions on details.securityOrigin or do not embed such iframes are not affected. The issue is addressed in Electron versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.

The vulnerability can lead to unauthorized device access (serial-port, camera, microphone) by cross-origin iframes if the application uses origin-based permission logic relying on requestingOrigin. This could result in a confidentiality breach of media or serial port devices. However, the impact is limited to applications that embed cross-origin iframes with delegated device permissions and use the affected permission check handler logic. There is no indication of integrity or availability impact.

A fix is available in Electron versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1. Applications should upgrade to one of these versions or later. As a workaround, applications can check details.securityOrigin instead of requestingOrigin in their permission check handlers or avoid delegating device permissions to untrusted cross-origin iframes.