{"id":"EUVD-2026-107347","enisaUuid":"4ca0e4c3-5988-34a9-9f94-c0f3cde296a4","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame\u0027s origin and details instead of the requesting frame\u0027s. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.","datePublished":"Oct 21, 2026, 4:16:45 PM","dateUpdated":"Oct 23, 2026, 3:12:01 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw\nhttps://github.com/electron/electron/pull/53656\nhttps://github.com/electron/electron/pull/53679\nhttps://github.com/electron/electron/pull/53688\nhttps://github.com/electron/electron/pull/53689\nhttps://github.com/electron/electron/pull/53736\nhttps://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a\nhttps://github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742\nhttps://github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0\nhttps://github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd\nhttps://github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0\nhttps://github.com/electron/electron/releases/tag/v42.11.3\nhttps://github.com/electron/electron/releases/tag/v43.7.0\nhttps://github.com/electron/electron/releases/tag/v44.3.0\nhttps://github.com/electron/electron/releases/tag/v45.0.0-alpha.5\n","aliases":"CVE-2026-113800\nGHSA-fw47-9c62-h3vw\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"328140e5-1a06-3331-9efd-1a6af3ef727b","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"43.0.0-alpha.1, \u003c 43.7.0"},{"id":"746154cd-b0bd-339a-b6fb-731bb064a41a","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 42.11.3"},{"id":"774ad03b-3b29-3aea-8cbb-53c8f448d902","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"45.0.0-alpha.1, \u003c 45.0.0-alpha.5"},{"id":"c73a0160-0e82-3995-9075-754c6f94ad90","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"44.0.0-alpha.1, \u003c 44.3.0"}],"enisaIdVendor":[{"id":"252f7161-40bb-3b96-ad7d-3ec63b3fe81a","vendor":{"name":"electron"}}],"enisaIdVulnerability":[{"id":"242862d0-c946-3314-8ee7-8e26e4938a75","vulnerability":{"id":"CVE-2026-113800","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame\u0027s origin and details instead of the requesting frame\u0027s. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.","datePublished":"Oct 21, 2026, 4:16:45 PM","dateUpdated":"Oct 23, 2026, 3:12:01 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw\nhttps://github.com/electron/electron/pull/53656\nhttps://github.com/electron/electron/pull/53679\nhttps://github.com/electron/electron/pull/53688\nhttps://github.com/electron/electron/pull/53689\nhttps://github.com/electron/electron/pull/53736\nhttps://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a\nhttps://github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742\nhttps://github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0\nhttps://github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd\nhttps://github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0\nhttps://github.com/electron/electron/releases/tag/v42.11.3\nhttps://github.com/electron/electron/releases/tag/v43.7.0\nhttps://github.com/electron/electron/releases/tag/v44.3.0\nhttps://github.com/electron/electron/releases/tag/v45.0.0-alpha.5\n","enisa_id":"EUVD-2026-107347\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 4, 2026, 7:14:20 AM","vulnerabilityProduct":[{"id":"2756d18f-bc21-3efd-9269-a33023e7a461","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"44.0.0-alpha.1, \u003c 44.3.0"},{"id":"7556e0a4-f54b-3ed0-a5e0-babe16275493","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"43.0.0-alpha.1, \u003c 43.7.0"},{"id":"b583a420-c20a-3148-b82e-e39ace8af4aa","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 42.11.3"},{"id":"bb102430-dd33-38c8-82a5-f14de9d1eac0","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"45.0.0-alpha.1, \u003c 45.0.0-alpha.5"}],"vulnerabilityVendor":[{"id":"5fa29572-a2ec-3a1f-958d-0c521755e640","vendor":{"name":"electron"}}]}},{"id":"4113128e-4164-3399-af64-169fb8b4b773","vulnerability":{"id":"GHSA-fw47-9c62-h3vw","description":"Electron: HID and USB permission checks can be attributed to the wrong origin","datePublished":"Oct 21, 2026, 5:21:51 PM","dateUpdated":"Oct 21, 2026, 5:21:51 PM","baseScore":0.0,"references":"https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw\nhttps://github.com/electron/electron/pull/53656\nhttps://github.com/electron/electron/pull/53679\nhttps://github.com/electron/electron/pull/53688\nhttps://github.com/electron/electron/pull/53689\nhttps://github.com/electron/electron/pull/53736\nhttps://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a\nhttps://github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742\nhttps://github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0\nhttps://github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd\nhttps://github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0\nhttps://github.com/electron/electron\nhttps://github.com/electron/electron/releases/tag/v42.11.3\nhttps://github.com/electron/electron/releases/tag/v43.7.0\nhttps://github.com/electron/electron/releases/tag/v44.3.0\nhttps://github.com/electron/electron/releases/tag/v45.0.0-alpha.5\n","enisa_id":"EUVD-2026-107347\n","aliases":"CVE-2026-113800\nGHSA-fw47-9c62-h3vw\n","epss":0.0,"dataProcessed":"Nov 4, 2026, 7:03:17 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}