CVE-2026-113798 · GHSA-x562-297c-g43g
Electron: Pointer lock permission requests can be attributed to the wrong frame
- Risk score
- 40/100
- CVSS
- 5.4 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requesting…
- Affected
- electron (npm) >= 45.0.0-alpha.1, < 45.0.0-alpha.13; electron (npm) >= 44.0.0-alpha.1, < 44.5.0; electron (npm) >= 43.0.0-alpha.1, < 43.7.6; electron (npm) < 42.11.9
- Fix
- Upgrade electron to 45.0.0-alpha.13 or 44.5.0 or 43.7.6 or 42.11.9 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
electron: Amber, patch this week. Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds…
The flaws
- CVE-2026-113798: Electron: Pointer lock permission requests can be attributed to the wrong frame (CVSS 5.4 · EPSS 0%)
- CVE-2026-115570: Electron: Mitigation for compromised eMudhra intermediate certificates (CVSS 7.4 · EPSS 0%)
- CVE-2026-102675: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled (CVSS 7.4 · EPSS 0%)
- CVE-2026-102672: Electron: Local race condition in Squirrel.Mac update installation on macOS (CVSS 6.7 · EPSS 0%)
The fix
Upgrade electron: 42.11.9 · 43.7.6 · 44.5.0 · 45.0.0 · 42.11.16 · 43.8.1 or later on your release line
Who is exposed: electron (npm) >= 45.0.0-alpha.1, < 45.0.0-beta.6; electron (npm) >= 44.0.0-alpha.1, < 44.9.1; electron (npm) >= 43.0.0-alpha.1, < 43.8.1; electron (npm) < 42.11.16
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-346 (CWE-346). 55 other warnings in 30 days
Why it is Yellow
- CVSS 5.4 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| electron | npm | >= 45.0.0-alpha.1, < 45.0.0-alpha.13 | 45.0.0-alpha.13 |
| electron | npm | >= 44.0.0-alpha.1, < 44.5.0 | 44.5.0 |
| electron | npm | >= 43.0.0-alpha.1, < 43.7.6 | 43.7.6 |
| electron | npm | < 42.11.9 | 42.11.9 |
References
- https://github.com/advisories/GHSA-x562-297c-g43g
- https://github.com/electron/electron/security/advisories/GHSA-x562-297c-g43g
- https://nvd.nist.gov/vuln/detail/CVE-2026-113798
- https://github.com/electron/electron/pull/54432
- https://github.com/electron/electron/pull/54463
- https://github.com/electron/electron/pull/54464
- https://github.com/electron/electron/pull/54465
- https://github.com/electron/electron/pull/54466
- https://github.com/electron/electron/commit/076c7496791a45968cf8d9e76e9657bc161ea979
- https://github.com/electron/electron/commit/0b680cfa1ffa70a50282da53efde37a210d5223b
Original description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded content are not affected. This issue is fixed in versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13.
Last activity 21 Oct 2026. Patch Forecast updates every hour.