Executive brief
Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw was found where an application could be tricked into connecting to a USB device that should have been restricted or filtered out by the app's settings. While this could allow unauthorized access to certain hardware, high-security devices on the global WebUSB blocklist remain protected.
Technical details
A missing authorization check (CWE-862) exists in Electron's WebUSB implementation. The 'select-usb-device' event callback failed to validate the chosen device ID against the filtered list provided to the handler. If an attacker can influence the handler's selection logic, they could grant the renderer process access to a USB device that was explicitly excluded via 'exclusionFilters' or did not match requested filters. The vulnerability is mitigated by the fact that the global WebUSB security blocklist is still enforced, and exploitation requires specific, unusual device-selection logic within the host application. Patches are available in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.
Affected products
- ElectronJS Electron < 38.8.6, >= 39.0.0-alpha.1 < 39.8.0, >= 40.0.0-alpha.1 < 40.7.0, >= 41.0.0-alpha.1 < 41.0.0-beta.8
Timeline
- 2026-04-02: advisory: GitHub Advisory GHSA-9899-m83m-qhpj published
- 2026-04-04: disclosed: CVE-2026-34766 published to NVD