CVE-2026-113800: Electron HID and USB Permission Check Vulnerability
Summary
CVE-2026-113800: Electron: HID and USB permission checks can be attributed to the wrong origin. Affects electron across 4 version ranges.
< 42.11.3
>= 43.0.0-alpha.1, < 43.7.0
>= 44.0.0-alpha.1, < 44.3.0
>= 45.0.0-alpha.1, < 45.0.0-alpha.5
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is a popular framework that allows developers to build cross-platform desktop applications using web technologies like JavaScript, HTML, and CSS. It provides a rich set of APIs, including access to hardware features such as HID (Human Interface Devices) and USB. This vulnerability arises from improper permission checks for these features when accessed from iframes, potentially allowing unauthorized access.
Vulnerability Detail
The vulnerability occurs in Electron's handling of permission checks for HID and USB when invoked from an iframe. Specifically, the function session.setPermissionCheckHandler incorrectly uses the top-level frame's origin instead of the requesting frame's origin. This flaw can lead to security issues where an embedded iframe could gain access to hardware features that should be restricted to the top-level page. Applications that rely on origin-based permission checks and allow cross-origin iframes with allow="hid" or allow="usb" are particularly at risk.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 42.11.342.11.3npm install electron@42.11.3 -
>= 43.0.0-alpha.1, < 43.7.043.7.0npm install electron@43.7.0 -
>= 44.0.0-alpha.1, < 44.3.044.3.0npm install electron@44.3.0 -
>= 45.0.0-alpha.1, < 45.0.0-alpha.545.0.0-alpha.5npm install electron@45.0.0-alpha.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, avoid adding allow="hid" or allow="usb" to untrusted iframes. Instead, implement permission checks directly in your select-hid-device or select-usb-device handler by using the details.frame property to determine the requesting frame's origin. Example code snippet:
session.setPermissionCheckHandler((details, callback) => {
if (details.frame === 'trusted-frame-origin') {
callback(true); // Allow access
} else {
callback(false); // Deny access
}
});
Conclusion
In summary, CVE-2026-113800 presents a security risk in Electron related to improper permission checks for HID and USB access from iframes. It is crucial to update to the patched versions or implement the suggested workarounds to mitigate potential risks.
See every vulnerability recorded for electron →
FAQ
CVE-2026-113800 is a vulnerability in Electron that affects permission checks for HID and USB access when invoked from iframes, potentially allowing unauthorized access.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The fixed versions of Electron are 45.0.0-alpha.5, 44.3.0, 43.7.0, and 42.11.3.
As a workaround, avoid using allow="hid" or allow="usb" in untrusted iframes and implement permission checks in your device selection handlers.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
