CVE-2026-113798Medium· 5.4▾ SunlitElectron: Pointer lock permission requests can be attributed to the wrong frame
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.2%
For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.
Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not embed untrusted content, or that deny pointerLock for it, are not affected.
Deny the pointerLock permission for web contents that embed untrusted frames.
45.0.0-alpha.1344.5.043.7.642.11.9If you have any questions or comments about this advisory, email us at [email protected]
electron >= 45.0.0-alpha.1, < 45.0.0-alpha.13electron >= 44.0.0-alpha.1, < 44.5.0electron >= 43.0.0-alpha.1, < 43.7.6electron < 42.11.9Upgrade to a patched release:
electron 45.0.0-alpha.13electron 44.5.0electron 43.7.6electron 42.11.9Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin
CVE-2026-114121Medium· 5.4Electron: openExternal permission requests can be attributed to the wrong origin
CVE-2026-102673High· 8.2Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-102675High· 7.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-70599Medium· 5.9Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS
CVE-2026-115570High· 7.4Electron: Mitigation for compromised eMudhra intermediate certificates