Electron: Pointer lock permission requests can be attributed to the wrong frame
### Impact For `pointerLock` permission requests made from some cross-origin iframes, `session.setPermissionRequestHandler()` was given the top-level frame's `requestingUrl` and `isMainFrame` instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity. Apps are only affected if they embed untrusted content in iframes and decide `pointerLock` requests by origin in `setPermissionRequestHandler`. Apps that do not embed untrusted content, or that deny `pointerLock` for it, are not affected. ### Workarounds Deny the `pointerLock` permission for web contents that embed untrusted frames. ### Fixed Versions * `45.0.0-alpha.13` * `44.5.0` * `43.7.6` * `42.11.9` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-113798US | — | — | ||
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/electron/electronPACKAGE
- https://github.com/electron/electron/commit/076c7496791a45968cf8d9e76e9657bc161ea979WEB
- https://github.com/electron/electron/commit/0b680cfa1ffa70a50282da53efde37a210d5223bWEB
- https://github.com/electron/electron/commit/1755ee598697356959219beefee1e139bc3f8207WEB
- https://github.com/electron/electron/commit/4073e9f4712f61e6b8abd5548673cc7638f6c1a1WEB
- https://github.com/electron/electron/commit/a48e6eaaafa85b6fc40f7431ceec4fd6ef4bb899WEB
- https://github.com/electron/electron/pull/54432WEB
- https://github.com/electron/electron/pull/54463WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan