{"id":"GHSA-fw47-9c62-h3vw","revision":"69d889725bde448eaa725c48502a9743","records":[{"revision":"69d889725bde448eaa725c48502a9743","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-fw47-9c62-h3vw","aliases":["CVE-2026-113800"],"title":"Electron: HID and USB permission checks can be attributed to the wrong origin","description":"### Impact\nFor `hid` and `usb` permission checks made from an iframe, `session.setPermissionCheckHandler` was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.\n\nYou're only affected if you use `setPermissionCheckHandler` with origin-based logic for `hid` or `usb` and embed cross-origin iframes with `allow=\"hid\"` or `allow=\"usb\"`. Apps that don't delegate those features to untrusted iframes are not affected.\n\n### Workarounds\nDon't add `allow=\"hid\"` / `allow=\"usb\"` to untrusted iframes, or make the decision in your `select-hid-device` / `select-usb-device` handler using `details.frame`.\n\n### Fixed Versions\n* `45.0.0-alpha.5`\n* `44.3.0`\n* `43.7.0`\n* `42.11.3`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)","state":0,"publishedAt":"2026-10-21T17:21:51+00:00","modifiedAt":"2026-10-21T17:35:19.8791309+00:00","affected":[{"ecosystem":"npm","name":"electron","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"45.0.0-alpha.1"},{"kind":"fixed","version":"45.0.0-alpha.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"electron","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"44.0.0-alpha.1"},{"kind":"fixed","version":"44.3.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"electron","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"43.0.0-alpha.1"},{"kind":"fixed","version":"43.7.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"electron","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"42.11.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/electron/electron/security/advisories/GHSA-fw47-9c62-h3vw","https://github.com/electron/electron/pull/53656","https://github.com/electron/electron/pull/53679","https://github.com/electron/electron/pull/53688","https://github.com/electron/electron/pull/53689","https://github.com/electron/electron/pull/53736","https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a","https://github.com/electron/electron/commit/36042b2e1b1c60c67b05ba0e95d1a34f608b9742","https://github.com/electron/electron/commit/56cc43eb677d46b86b0d3f49b5fba71404ab1ff0","https://github.com/electron/electron/commit/922073f8601479e93071f56f0745041291b206fd","https://github.com/electron/electron/commit/c965cee73284c4b230a81d51a7db6115e55da8c0","https://github.com/electron/electron","https://github.com/electron/electron/releases/tag/v42.11.3","https://github.com/electron/electron/releases/tag/v43.7.0","https://github.com/electron/electron/releases/tag/v44.3.0","https://github.com/electron/electron/releases/tag/v45.0.0-alpha.5"],"sourceUrl":"https://github.com/advisories/GHSA-fw47-9c62-h3vw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-fw47-9c62-h3vw","identifiers":["GHSA-fw47-9c62-h3vw","CVE-2026-113800"]},"retained":false,"historicalAffected":[]}],"coverage":[]}