Threats tagged 'ghsa-9pf5-hg6p-4pwp'

A vulnerability in Electron prior to versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1 causes the permission check handler to receive the main frame origin instead of the requesting iframe origin for serial-port and media device permissions. This can lead to cross-origin iframes gaining device access intended only for the top-level origin if the app uses origin-based logic with setPermissionCheckHandler. The issue affects apps that embed cross-origin iframes with delegated device permissions and use requestingOrigin for permission decisions. The vulnerability is fixed in the stated versions.