medium

CVE-2026-113798

npm · electron

Summary

Electron: Pointer lock permission requests can be attributed to the wrong frame

Severity
medium
CVSS
5.4
EPSS
0.2% (p15)
CWE
CWE-346
Also known as
GHSA-x562-297c-g43g
Published
2026-10-22
Updated
2026-10-22

Advisory details

Impact

For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.

Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not embed untrusted content, or that deny pointerLock for it, are not affected.

Workarounds

Deny the pointerLock permission for web contents that embed untrusted frames.

Fixed Versions

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.