CVE-2026-113798

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.9 Electron versions prior to 43.7.6 Electron versions prior to 44.5.0 Electron versions prior to 45.0.0-alpha.13

Description Pointer lock permission requests originating from certain cross-origin iframes cause the session.setPermissionRequestHandler() function to receive the requestingUrl and isMainFrame values of the top-level frame rather than those of the actual requesting frame. This can lead to a scenario where an application embedding untrusted iframe content grants pointer lock permissions under the identity of the top-level page if the grant is based on the requesting origin.

Recommendations Update to version 42.11.9 Update to version 43.7.6 Update to version 44.5.0 Update to version 45.0.0-alpha.13