Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page containing the link as the initiator. The resulting top-level request could be classified as same-site, causing SameSite=Strict cookies to be sent and Sec-Fetch-Site not to identify the initiating page. An application that loads untrusted content and permits it to open new windows could therefore allow that content to make a credentialed request to another site that relies on SameSite cookies for CSRF protection. This issue is fixed in versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-352"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113796.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "42.11.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "43.0.0-alpha.1"
},
{
"fixed": "43.7.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "44.0.0-alpha.1"
},
{
"fixed": "44.3.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "45.0.0-alpha.1"
},
{
"fixed": "45.0.0-alpha.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "079b9b1594ee62c336adc3aa430d4c1cf62bd51e"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "0e6aca0618eeae50a18cfd50548b8688820629ed"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "652ef79ac79c6767b31e59b2f28d0d46114645e5"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "98940cb274bb6adcb7cdb2da2d4495ac83119670"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "a86ae4205ba2ba7ae60a6caa9d5d3a44321f2f9b"
}
],
"source": "REFERENCES_COMMIT"
},
{
"original_tag": "v42.11.3",
"range": [
{
"fixed": "22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v43.7.0",
"range": [
{
"fixed": "c440db52c29668e848f02e374720e15b6025a132"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v44.3.0",
"range": [
{
"fixed": "07e460719c75b2ec5ee4893f7d2192ef31c7b8c2"
}
],
"source": "REFERENCES_TAG"
},
{
"original_tag": "v45.0.0-alpha.6",
"range": [
{
"fixed": "b3229a93ed98e874b42a9ce10a3ff04d5a5c7a38"
}
],
"source": "REFERENCES_TAG"
}
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113796.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "163586886553495020899273651332277353361",
"length": 215
},
"id": "CVE-2026-113796-085dbbad",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a",
"target": {
"file": "shell/browser/hid/electron_hid_delegate.cc",
"function": "ElectronHidDelegate::RevokeDevicePermission"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"30733339006105355245052872306811182833",
"222510834209146764500021974956139701101",
"206767968580460205012676737947443926819",
"30359066161464646972084089694663822995",
"263427290684820219797471987957316989467",
"62210930964964233319713980838198773147",
"150487143547718657700295484299883280965",
"266907474610371501889355648296406893409",
"330203671325377721118428501435063718324",
"39293461437665441668761093695796026877",
"119748850264480792139757414116824082263",
"32507267288553988605590440870395137836",
"262298595830271058940039107254682945258",
"149656858845034303125525686325597455151"
],
"threshold": 0.9
},
"id": "CVE-2026-113796-0f9ea22e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/652ef79ac79c6767b31e59b2f28d0d46114645e5",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"326218879459004559781072808259221659115",
"128793237539922115802648908467861155715",
"206767968580460205012676737947443926819",
"30359066161464646972084089694663822995",
"263427290684820219797471987957316989467",
"62210930964964233319713980838198773147",
"150487143547718657700295484299883280965",
"266907474610371501889355648296406893409",
"330203671325377721118428501435063718324",
"39293461437665441668761093695796026877",
"119748850264480792139757414116824082263",
"32507267288553988605590440870395137836",
"262298595830271058940039107254682945258",
"149656858845034303125525686325597455151"
],
"threshold": 0.9
},
"id": "CVE-2026-113796-24af0be3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/a86ae4205ba2ba7ae60a6caa9d5d3a44321f2f9b",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"337833659570664803569687100676255122278",
"278933063342990246185833272610580769425",
"204831099482400612171164869838911756959",
"136925865731599307973958830626379419330"
],
"threshold": 0.9
},
"id": "CVE-2026-113796-368ce75b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a",
"target": {
"file": "shell/browser/usb/electron_usb_delegate.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "8597325686380026973445435126469704642",
"length": 426
},
"id": "CVE-2026-113796-45b959c3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a",
"target": {
"file": "shell/browser/usb/electron_usb_delegate.cc",
"function": "ElectronUsbDelegate::CanRequestDevicePermission"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"326218879459004559781072808259221659115",
"128793237539922115802648908467861155715",
"206767968580460205012676737947443926819",
"30359066161464646972084089694663822995",
"263427290684820219797471987957316989467",
"62210930964964233319713980838198773147",
"150487143547718657700295484299883280965",
"266907474610371501889355648296406893409",
"330203671325377721118428501435063718324",
"39293461437665441668761093695796026877",
"119748850264480792139757414116824082263",
"32507267288553988605590440870395137836",
"262298595830271058940039107254682945258",
"149656858845034303125525686325597455151"
],
"threshold": 0.9
},
"id": "CVE-2026-113796-4fe5f2a7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/079b9b1594ee62c336adc3aa430d4c1cf62bd51e",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "51582338272732942098801942961526581766",
"length": 310
},
"id": "CVE-2026-113796-57a311c4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a",
"target": {
"file": "shell/browser/usb/electron_usb_delegate.cc",
"function": "ElectronUsbDelegate::HasDevicePermission"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"251339166431400156258641482181652383196",
"241053059275460752244980986587633478031",
"176190167618651076993428639269135182047",
"255856782894506886973206959419891807373",
"16546226106584424423614789800472752638",
"331436663682890405151090558513990720145",
"316247753605533748555666534455864970055",
"126368555040970648003829247749518953464",
"86333989567915036090314002651797828556",
"128492383848679681357922241016220871231",
"309033919043165282652445634684743844527",
"49777337493613529201731365427662207105",
"45526587900057601924304439159949463341",
"208084171039495028768404609212818471816",
"182710850551066657877656302035900593864",
"274402512350065896440043170577607644235",
"132511270054107308479054294203518222774",
"258648471330194225844344166607358878232",
"55117467926907042909459432267200248096",
"141759276092471824154800062870720710289",
"260691864562120722254656833603851043295",
"177335370951975179925746028105652355355",
"224569255777314534266225627271434241729",
"164998215844675137900485363058016324320",
"313679953828100408659267986799776857640",
"219784173358766722689329403467704177114",
"156604433431792562646407015326721836519",
"191148989308487063289093520278445462459",
"10855836476249249579317754759425391224"
],
"threshold": 0.9
},
"id": "CVE-2026-113796-63f8c89f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a",
"target": {
"file": "shell/browser/hid/electron_hid_delegate.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "309559740215024087819771014782432615011",
"length": 426
},
"id": "CVE-2026-113796-73df4ddc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a",
"target": {
"file": "shell/browser/hid/electron_hid_delegate.cc",
"function": "ElectronHidDelegate::CanRequestDevicePermission"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"78057749163180614907913457560777050855",
"28761536658953719635641160297604695698",
"139611953175832713884193059605060434660",
"56182777345936070893156066904095592256",
"80904906129972713872510273229766878273",
"250148029603479831695456355029567537527",
"309033919043165282652445634684743844527",
"49777337493613529201731365427662207105",
"45526587900057601924304439159949463341",
"208084171039495028768404609212818471816",
"182710850551066657877656302035900593864",
"274402512350065896440043170577607644235",
"33449349429210178706226115463727771883",
"25406093755487108401573379880553522961",
"79346232228210802267249958083713116146",
"230867383278725916655045495423991129364",
"111314221022282660911469869197071317787",
"105465064303334119909647610177025057071",
"56300472350855581515598761316943100206",
"337533410712794706756146602810494347386",
"50181101377865185785790942792822624177",
"285388295967738092524543836663359978405",
"214727336289095135146439607137484261116",
"317705517834438629309631973655625518751",
"34393896507118281324640815626080192994",
"7186133781887397400304992121749562866"
],
"threshold": 0.9
},
"id": "CVE-2026-113796-917bbf06",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a",
"target": {
"file": "shell/browser/usb/electron_usb_delegate.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"30733339006105355245052872306811182833",
"222510834209146764500021974956139701101",
"206767968580460205012676737947443926819",
"30359066161464646972084089694663822995",
"263427290684820219797471987957316989467",
"62210930964964233319713980838198773147",
"150487143547718657700295484299883280965",
"266907474610371501889355648296406893409",
"330203671325377721118428501435063718324",
"39293461437665441668761093695796026877",
"119748850264480792139757414116824082263",
"32507267288553988605590440870395137836",
"262298595830271058940039107254682945258",
"149656858845034303125525686325597455151"
],
"threshold": 0.9
},
"id": "CVE-2026-113796-c447ca2d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/98940cb274bb6adcb7cdb2da2d4495ac83119670",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "88018023917651873008628947603948773125",
"length": 208
},
"id": "CVE-2026-113796-db0bafa0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a",
"target": {
"file": "shell/browser/hid/electron_hid_delegate.cc",
"function": "ElectronHidDelegate::HasDevicePermission"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"239993165935455445360783736795255822276",
"151835440110402971718661854296842841509",
"147572887431725779945503003725094041599",
"186533614786520719398105935749181011815"
],
"threshold": 0.9
},
"id": "CVE-2026-113796-e3af19c9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/22de0a3a06cfd3174fc6c59c3810ab5e1c91bf1a",
"target": {
"file": "shell/browser/hid/electron_hid_delegate.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"326218879459004559781072808259221659115",
"128793237539922115802648908467861155715",
"206767968580460205012676737947443926819",
"30359066161464646972084089694663822995",
"263427290684820219797471987957316989467",
"62210930964964233319713980838198773147",
"150487143547718657700295484299883280965",
"266907474610371501889355648296406893409",
"330203671325377721118428501435063718324",
"39293461437665441668761093695796026877",
"119748850264480792139757414116824082263",
"32507267288553988605590440870395137836",
"262298595830271058940039107254682945258",
"149656858845034303125525686325597455151"
],
"threshold": 0.9
},
"id": "CVE-2026-113796-f7bdb615",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/electron/electron/commit/0e6aca0618eeae50a18cfd50548b8688820629ed",
"target": {
"file": "shell/browser/api/electron_api_web_contents.cc"
}
}
]
"2026-11-11T07:19:05Z"