{"id":"CVE-2026-113800","title":"Electron: HID and USB permission checks can be attributed to the wrong origin","summary":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermission…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-346"],"vendor":"electron","product":"electron","affected":["electron < 42.11.3","electron >= 43.0.0-alpha.1, < 43.7.0","electron >= 44.0.0-alpha.1, < 44.3.0","electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T14:47:52.711295Z"},"published":"2026-10-21","updated":"2026-10-23","sourceUpdated":"2026-10-23T15:12:01.887Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113800","references":[{"url":"https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw","label":"https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw"},{"url":"https://github.com/electron/electron/pull/53656","label":"https://github.com/electron/electron/pull/53656"},{"url":"https://github.com/electron/electron/pull/53679","label":"https://github.com/electron/electron/pull/53679"},{"url":"https://github.com/electron/electron/pull/53688","label":"https://github.com/electron/electron/pull/53688"},{"url":"https://github.com/electron/electron/pull/53689","label":"https://github.com/electron/electron/pull/53689"},{"url":"https://github.com/electron/electron/pull/53736","label":"https://github.com/electron/electron/pull/53736"},{"url":"https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a","label":"https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a"},{"url":"https://github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742","label":"https://github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742"},{"url":"https://github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0","label":"https://github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0"},{"url":"https://github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd","label":"https://github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd"},{"url":"https://github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0","label":"https://github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0"},{"url":"https://github.com/electron/electron/releases/tag/v42.11.3","label":"https://github.com/electron/electron/releases/tag/v42.11.3"},{"url":"https://github.com/electron/electron/releases/tag/v43.7.0","label":"https://github.com/electron/electron/releases/tag/v43.7.0"},{"url":"https://github.com/electron/electron/releases/tag/v44.3.0","label":"https://github.com/electron/electron/releases/tag/v44.3.0"},{"url":"https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5","label":"https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5"},{"url":"https://github.com/advisories/GHSA-fw47-9c62-h3vw"}],"tags":["cve.org","ghsa","npm"],"epss":0.00241,"epssPercentile":0.15187,"aliases":["GHSA-fw47-9c62-h3vw"],"ecosystem":"npm","patched":["electron 45.0.0-alpha.5","electron 44.3.0","electron 43.7.0","electron 42.11.3"],"ingestedAt":"2026-10-21T17:07:51.301Z","slug":"CVE-2026-113800","body":"## Overview\n\nElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.\n\n## Affected\n\n- `electron < 42.11.3`\n- `electron >= 43.0.0-alpha.1, < 43.7.0`\n- `electron >= 44.0.0-alpha.1, < 44.3.0`\n- `electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-113800)\n\nAffected packages:\n\n- `electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5`\n- `electron >= 44.0.0-alpha.1, < 44.3.0`\n- `electron >= 43.0.0-alpha.1, < 43.7.0`\n- `electron < 42.11.3`\n\nPatched in:\n\n- `electron 45.0.0-alpha.5`\n- `electron 44.3.0`\n- `electron 43.7.0`\n- `electron 42.11.3`\n\nSource: https://github.com/advisories/GHSA-fw47-9c62-h3vw","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}