## Electron: HID and USB permission checks can be attributed to the wrong origin

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs, electron
- CVE: CVE-2026-113800
- 公開日時: 2026-10-21T17:21:51.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-fw47-9c62-h3vw)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-fw47-9c62-h3vw

影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.5 → 45.0.0-alpha.5, npm:electron >= 44.0.0-alpha.1, < 44.3.0 → 44.3.0, npm:electron >= 43.0.0-alpha.1, < 43.7.0 → 43.7.0, npm:electron < 42.11.3 → 42.11.3
Impact For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page. You're only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow="hid" or allow="usb". Apps that don't delegate those featu…