Cross-Origin Frame Vulnerability in Electron Framework
CVE-2026-113798
5.4MEDIUM
What is CVE-2026-113798?
The Electron framework faces a vulnerability where pointerLock permission requests from cross-origin iframes can incorrectly expose the top-level frame's identity instead of the requesting frame's identity. This misconfiguration allows applications embedding untrusted iframe content to unintentionally grant pointer lock permissions based on the top-level page's context, potentially leading to unauthorized access and control. Versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13 have resolved this issue, securing applications against these misuse scenarios.
Affected Version(s)
electron < 42.11.9 < 42.11.9
electron >= 43.0.0-alpha.1, < 43.7.6 < 43.0.0-alpha.1, 43.7.6
electron >= 44.0.0-alpha.1, < 44.5.0 < 44.0.0-alpha.1, 44.5.0