CVE-2026-113798: Electron pointer lock permission bypass in cross-origin iframes

CVE-2026-113798 · Severity: medium · CVSS 5.4 · Published 2026-10-21

Electron is a framework for building desktop applications with web technologies. A security flaw in how the framework handles permissions for pointer lock requests from embedded content could allow an untrusted iframe to gain pointer lock access under the top-level page's identity rather than its own. An application embedding untrusted iframes could inadvertently grant the permission to the wrong origin, potentially allowing malicious embedded content to restrict user input.

Technologies: Electron, electron (npm). Vendors: Electron, npm.

Quick answers

Is CVE-2026-113798 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-113798 being exploited in the wild.
How severe is CVE-2026-113798?
Medium severity, with a CVSS score of 5.4, published 21 October 2026.
Which products and versions are affected?
Electron before 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13; electron (npm) >= 45.0.0-alpha.1, < 45.0.0-alpha.13, SEMVER:introduced=45.0.0-alpha.1,fixed=45.0.0-alpha.13.
Is there a fix for CVE-2026-113798?
Yes. electron (npm): upgrade to 45.0.0-alpha.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113798 attacked?
It is attacked over the network.
Am I affected by CVE-2026-113798?
Check whether you run Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electron (npm): upgrade to 45.0.0-alpha.13 or later
    npm install electron@45.0.0-alpha.13

Technical details

The vulnerability is a permission attribution bug in the pointer lock permission handler. When a cross-origin iframe (sharing the parent's renderer process) requests pointer lock, the session.setPermissionRequestHandler() callback receives the top-level frame's requestingUrl and isMainFrame values instead of the iframe's own values. This causes permission decisions based on origin to be evaluated against the wrong frame. An attacker can exploit this by embedding malicious content in a trusted iframe context to bypass origin-based permission checks.

Affected products

  • Electron Electron before 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13

Identifiers

  • CVE-2026-113798
  • GHSA-x562-297c-g43g

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.