{"id":"CVE-2026-113800","aliases":["GHSA-fw47-9c62-h3vw"],"title":"Electron: HID and USB permission checks can be attributed to the wrong origin","summary":"Electron: HID and USB permission checks can be attributed to the wrong origin","severity":"medium","cvss":5.4,"cwe":["CWE-346"],"vendor":"electron","product":"electron","ecosystem":"npm","affected":["electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5","electron >= 44.0.0-alpha.1, < 44.3.0","electron >= 43.0.0-alpha.1, < 43.7.0","electron < 42.11.3"],"patched":["electron 45.0.0-alpha.5","electron 44.3.0","electron 43.7.0","electron 42.11.3"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T17:21:53Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-fw47-9c62-h3vw","references":[{"url":"https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw"},{"url":"https://github.com/electron/electron/pull/53656"},{"url":"https://github.com/electron/electron/pull/53679"},{"url":"https://github.com/electron/electron/pull/53688"},{"url":"https://github.com/electron/electron/pull/53689"},{"url":"https://github.com/electron/electron/pull/53736"},{"url":"https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a"},{"url":"https://github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742"},{"url":"https://github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0"},{"url":"https://github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd"},{"url":"https://github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0"},{"url":"https://github.com/electron/electron/releases/tag/v42.11.3"},{"url":"https://github.com/electron/electron/releases/tag/v43.7.0"},{"url":"https://github.com/electron/electron/releases/tag/v44.3.0"},{"url":"https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5"},{"url":"https://github.com/advisories/GHSA-fw47-9c62-h3vw"}],"tags":["ghsa","npm","cve.org"],"ingestedAt":"2026-10-21T17:07:51.301Z","slug":"CVE-2026-113800","body":"## Overview\n\n### Impact\nFor `hid` and `usb` permission checks made from an iframe, `session.setPermissionCheckHandler` was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.\n\nYou're only affected if you use `setPermissionCheckHandler` with origin-based logic for `hid` or `usb` and embed cross-origin iframes with `allow=\"hid\"` or `allow=\"usb\"`. Apps that don't delegate those features to untrusted iframes are not affected.\n\n### Workarounds\nDon't add `allow=\"hid\"` / `allow=\"usb\"` to untrusted iframes, or make the decision in your `select-hid-device` / `select-usb-device` handler using `details.frame`.\n\n### Fixed Versions\n* `45.0.0-alpha.5`\n* `44.3.0`\n* `43.7.0`\n* `42.11.3`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)\n\n## Affected packages\n\n- `electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5`\n- `electron >= 44.0.0-alpha.1, < 44.3.0`\n- `electron >= 43.0.0-alpha.1, < 43.7.0`\n- `electron < 42.11.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `electron 45.0.0-alpha.5`\n- `electron 44.3.0`\n- `electron 43.7.0`\n- `electron 42.11.3`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}