Weak Access Controls in Electron Framework Affecting Device Permissions
CVE-2026-113800
What is CVE-2026-113800?
The Electron framework, widely used for building cross-platform desktop applications, has an access control vulnerability that affects device access permissions. Specifically, prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, the framework allowed permission checks from iframes to inherit the top-level origin instead of the requesting frame's origin. This design flaw could potentially enable untrusted iframes to gain unauthorized access to devices by exploiting origin-based logic in the application. Users are advised to update to the latest versions to mitigate this vulnerability.
Affected Version(s)
electron < 42.11.3 < 42.11.3
electron >= 43.0.0-alpha.1, < 43.7.0 < 43.0.0-alpha.1, 43.7.0
electron >= 44.0.0-alpha.1, < 44.3.0 < 44.0.0-alpha.1, 44.3.0