Electron: Pointer lock permission requests can be attributed to the wrong frame

影響: npm:electron >= 45.0.0-alpha.1, < 45.0.0-alpha.13 → 45.0.0-alpha.13, npm:electron >= 44.0.0-alpha.1, < 44.5.0 → 44.5.0, npm:electron >= 43.0.0-alpha.1, < 43.7.6 → 43.7.6, npm:electron < 42.11.9 → 42.11.9

For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity. Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not em…

在 GitHub Advisory Database 阅读

2026/10/23 01:47，GitHub Advisory Database 发布了“Electron: Pointer lock permission requests can be attributed to the wrong frame”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js、Electron。CVE：CVE-2026-113798。