CVE-2026-113798 electron CVE debrief

Who should care

Defenders responsible for Electron applications that embed untrusted content in iframes and use setPermissionRequestHandler to decide pointerLock requests by origin should assess exposure and prioritize remediation.

Why it matters

CVE-2026-113798 is a vulnerability in Electron that allows pointer lock permission requests to be attributed to the wrong frame, potentially leading to security risks for applications embedding untrusted content in iframes. Defenders should assess exposure and prioritize remediation for affected applications.

• Defenders must verify Electron application configurations to ensure proper permission handling for pointerLock requests.
• Affected applications may inadvertently grant pointer lock to untrusted content, potentially leading to security risks.
• Remediation priority is high for applications that both embed untrusted content and use setPermissionRequestHandler to decide pointerLock requests by origin.
• Further verification is required to determine the full scope of affected versions and potential exploitation.

Technical summary

The vulnerability occurs when pointerLock permission requests are made from some cross-origin iframes, causing session.setPermissionRequestHandler() to be given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. This can lead to affected applications granting pointer lock to embedded content under the top-level page's identity. Electron applications embedding untrusted content in iframes and deciding pointerLock requests by origin in setPermissionRequestHandler may be affected. The vulnerability has been fixed in Electron versions 45.0.0-alpha.13, 44.5.0, 43.7.6, and 42.11.9.

Defensive priority

Defenders should assess exposure and prioritize remediation for Electron applications that embed untrusted content in iframes and use setPermissionRequestHandler to decide pointerLock requests by origin.

Recommended defensive actions

• Assess exposure of Electron applications embedding untrusted content in iframes and using setPermissionRequestHandler to decide pointerLock requests by origin.
• Prioritize remediation for affected Electron applications.
• Verify Electron version and update to a fixed version if necessary.
• Deny pointerLock permission for web contents that embed untrusted frames as a workaround.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The source corpus provides details on the vulnerability, its impact, and fixed versions. However, it does not provide information on exploitation or affected versions beyond the specified ranges. Defenders should verify Electron application configurations to ensure proper permission handling for pointerLock requests and assess exposure of Electron applications embedding untrusted content in iframes and using setPermissionRequestHandler to decide pointerLock requests by origin.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.