{"id":"ghsa-ghsa-fw47-9c62-h3vw","seq":32726,"kind":"advisory","title":"Electron: HID and USB permission checks can be attributed to the wrong origin","url":"https://github.com/advisories/GHSA-fw47-9c62-h3vw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-fw47-9c62-h3vw","summary":"影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5 → 45.0.0-alpha.5, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron < 42.11.3 → 42.11.3\nImpact For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page. You're only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow=\"hid\" or allow=\"usb\". Apps that don't delegate those featu…","severity":"medium","techs":["nodejs","electron"],"cves":["CVE-2026-113800"],"tags":["GHSA-fw47-9c62-h3vw","electron","electron","electron","electron"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T17:21:51.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}