CVE-2026-113800: Electron: HID and USB permission checks can be attributed to the wrong origin
Impact For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.
You're only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow="hid" or allow="usb". Apps that don't delegate those features to untrusted iframes are not affected.
Workarounds Don't add allow="hid" / allow="usb" to untrusted iframes, or make the decision in your select-hid-device / select-usb-device handler using details.frame.
Fixed Versions 45.0.0-alpha.5 44.3.0 43.7.0 42.11.3
For more information If you have any questions or comments about this advisory, email us at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.11.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.7.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 44.3.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.5 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.7.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.3.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.5 - Configuration
Do not add allow="hid" or allow="usb" to untrusted iframes.
Untrusted cross-origin iframes allow="hid" / allow="usb" = disabled - Compensating control
For hid or usb permission decisions, use details.frame in the select-hid-device or select-usb-device handler instead of relying only on origin-based logic.
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Affected applications are those using a vulnerable Electron version that delegate HID or USB access to a cross-origin iframe and make permission decisions using origin-based logic in setPermissionCheckHandler. Applications that do not grant these capabilities to untrusted cross-origin embedded content are not described as affected.
What does an attacker need to exploit it?
An attacker needs their untrusted cross-origin content to run in an iframe within the application and to reach a HID or USB permission path that the application allows based on the reported top-level origin. No privileges or user interaction are listed in the supplied severity vector.
How can I determine whether my application is vulnerable?
Review the Electron version and any setPermissionCheckHandler implementation for HID or USB permissions. If a cross-origin iframe can request either capability and the handler trusts the origin or details reported for the top-level frame, the iframe may receive access intended only for that top-level page.
What should be done if upgrading is not immediately possible?
Do not delegate HID or USB access to untrusted cross-origin iframes, and avoid allowing those permissions solely from the top-level origin reported to setPermissionCheckHandler. Restrict device access to trusted content until upgrading to 42.11.3, 43.7.0, 44.3.0, or 45.0.0-alpha.5.