~ / search / GHSA-x562-297c-g43g

GHSA-x562-297c-g43g

Electron: Pointer lock permission requests can be attributed to the wrong frame

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-113798

Packages

EcosystemPackageAffectedFixed in
npm electron >= 45.0.0-alpha.1, < 45.0.0-alpha.13 45.0.0-alpha.13
npm electron >= 44.0.0-alpha.1, < 44.5.0 44.5.0
npm electron >= 43.0.0-alpha.1, < 43.7.6 43.7.6
npm electron < 42.11.9 42.11.9

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact For `pointerLock` permission requests made from some cross-origin iframes, `session.setPermissionRequestHandler()` was given the top-level frame's `requestingUrl` and `isMainFrame` instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity. Apps are only affected if they embed untrusted content in iframes and decide `pointerLock` requests by origin in `setPermissionRequestHandler`. Apps that do not embed untrusted content, or that deny `pointerLock` for it, are not affected. ### Workarounds Deny the `pointerLock` permission for web contents that embed untrusted frames. ### Fixed Versions * `45.0.0-alpha.13` * `44.5.0` * `43.7.6` * `42.11.9` ### For more information If you have any questions or comments about this advisory, email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.