MediumGHSA-fw47-9c62-h3vwCVE-2026-113800

Electron: HID and USB permission checks can be attributed to the wrong origin

Published 21 Oct 2026 · Updated 21 Oct 2026

Affected packages

electronnpm

Affected: >=45.0.0-alpha.1 <45.0.0-alpha.5
Fixed in: 45.0.0-alpha.5

Update to the fixed version for your release line, for example:npm install electron@45.0.0-alpha.5

electronnpm

Affected: >=44.0.0-alpha.1 <44.3.0
Fixed in: 44.3.0

Update to the fixed version for your release line, for example:npm install electron@44.3.0

electronnpm

Affected: >=43.0.0-alpha.1 <43.7.0
Fixed in: 43.7.0

Update to the fixed version for your release line, for example:npm install electron@43.7.0

electronnpm

Affected: <42.11.3
Fixed in: 42.11.3

Update to the fixed version for your release line, for example:npm install electron@42.11.3

Details

Impact

For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.

You're only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow="hid" or allow="usb". Apps that don't delegate those features to untrusted iframes are not affected.

Workarounds

Don't add allow="hid" / allow="usb" to untrusted iframes, or make the decision in your select-hid-device / select-usb-device handler using details.frame.

Fixed Versions

45.0.0-alpha.5
44.3.0
43.7.0
42.11.3

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Is GHSA-fw47-9c62-h3vw in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected electron, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.