CVE-2026-113800

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.3 Electron versions prior to 43.7.0 Electron versions prior to 44.3.0 Electron versions prior to 45.0.0-alpha.5

Description Permission checks for hid and usb initiated from an iframe cause the setPermissionCheckHandler function to receive the origin and details of the top-level frame instead of the requesting frame. This can lead to a situation where an application using origin-based logic to grant device access inadvertently grants an untrusted cross-origin embedded iframe permissions intended for the top-level page.

Recommendations Update to version 42.11.3. Update to version 43.7.0. Update to version 44.3.0. Update to version 45.0.0-alpha.5. Avoid adding allow="hid" or allow="usb" to untrusted iframes. Use details.frame within the select-hid-device or select-usb-device handlers to make permission decisions.