Executive brief
Electron, a framework used to build desktop applications, contains a flaw in how it handles security permissions for embedded web content. An attacker could potentially bypass security checks to access sensitive hardware like cameras, microphones, or serial ports by tricking the system into thinking the request came from a trusted main window rather than an untrusted sub-frame. This could lead to unauthorized surveillance or data access if an application embeds untrusted third-party content.
Technical details
An origin validation error (CWE-346) exists in Electron's `session.setPermissionCheckHandler`. When an iframe requests access to media devices (camera/microphone) or serial ports, the `requestingOrigin` parameter incorrectly reflects the origin of the top-level frame instead of the actual requesting iframe. This allows a cross-origin iframe to inherit permissions intended only for the main application window if the developer's handler logic relies solely on `requestingOrigin`. The vulnerability is exploitable if an application embeds untrusted iframes and uses origin-based logic in its permission handler. Developers are advised to upgrade to patched versions or use `details.securityOrigin` as a workaround.
Affected products
- Electron Electron < 39.8.7, >= 40.0.0-alpha.1 < 40.9.0, >= 41.0.0-alpha.1 < 41.2.0, >= 42.0.0-alpha.1 < 42.0.0-beta.1
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory: GitHub Advisory published