CVE-2026-113800

The record

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and details instead of the requesting frame's. An application that delegated hid or usb to a cross-origin untrusted iframe and allowed device access with origin-based logic could therefore grant that embedded frame access intended for the top-level page. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5.

Affected packages

Related vulnerabilities

• CVE-2026-119331 Ladybird is a truly independent web browser. CWE-346
• CVE-2026-7005 WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request… CWE-346
• CVE-2026-119416 CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the… CWE-346
• CVE-2026-119285 Fiber is an Express inspired web framework written in Go. CWE-346
• CVE-2026-61546 AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to… CWE-346
• CVE-2026-118657 Echo is a Go web framework. CWE-346
• CVE-2026-118651 Echo is a Go web framework. CWE-346
• CVE-2026-115413 Missing token audience validation in the OAuth authentication mode of AWS API MCP Server… CWE-346