CVE-2026-113798: Electron pointer lock requests can use the wrong frame identity
Summary
CVE-2026-113798: Pointer lock permission checks can misidentify the requesting frame, allowing embedded content to receive permission under the top-level page's identity. Affects electron across 4 version ranges.
< 42.11.9
>= 43.0.0-alpha.1, < 43.7.6
>= 44.0.0-alpha.1, < 44.5.0
>= 45.0.0-alpha.1, < 45.0.0-alpha.13
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is a JavaScript framework in the npm ecosystem for building desktop applications. It lets developers create applications using web technologies and embed web content in application windows. Applications can handle permission requests through session.setPermissionRequestHandler, including requests for pointer lock from frames within embedded content.
Vulnerability Detail
Cross-origin frame attribution can cause unauthorized pointer lock permission grants. For some pointerLock requests from cross-origin iframes, Electron passes the top-level frame's requestingUrl and isMainFrame values to session.setPermissionRequestHandler instead of the requesting frame's values. Applications that grant pointer lock based on the requesting origin may therefore grant it to untrusted embedded content under the top-level page's identity. Applications that do not embed untrusted content, or deny its pointer lock requests, are not affected.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 42.11.942.11.9npm install electron@42.11.9 -
>= 43.0.0-alpha.1, < 43.7.643.7.6npm install electron@43.7.6 -
>= 44.0.0-alpha.1, < 44.5.044.5.0npm install electron@44.5.0 -
>= 45.0.0-alpha.1, < 45.0.0-alpha.1345.0.0-alpha.13npm install electron@45.0.0-alpha.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Documented workaround: Deny the pointerLock permission for web contents that embed untrusted frames. In Electron, apply this mitigation to permission decisions for those web contents until the dependency is upgraded.
// Example: deny pointerLock for web contents embedding untrusted frames
if (permission === 'pointerLock' && embedsUntrustedFrames) {
callback(false);
return;
}
Conclusion
Upgrade Electron to the fixed version for your release line: 45.0.0-alpha.13, 44.5.0, 43.7.6, or 42.11.9. If an upgrade is not yet possible, deny pointerLock permission for web contents that embed untrusted frames. Review the dependency recorded in package-lock.json to determine whether the application uses an affected release. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for electron →
FAQ
Electron is affected from 45.0.0-alpha.1, 44.0.0-alpha.1, 43.0.0-alpha.1, and earlier versions before their respective fixes.
CVE-2026-113798 can let embedded content receive pointer lock under the top-level page's identity when an application grants permission by origin.
Upgrade Electron to the fixed version for your release line: 45.0.0-alpha.13, 44.5.0, 43.7.6, or 42.11.9.
Deny pointerLock permission for Electron web contents that embed untrusted frames until you can upgrade.
Check package-lock.json for the Electron dependency and its resolved version. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
