GHSA-x562-297c-g43g

Suggest an improvement
Source
https://github.com/advisories/GHSA-x562-297c-g43g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x562-297c-g43g/GHSA-x562-297c-g43g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-x562-297c-g43g
Aliases
Published
2026-10-22T16:47:15Z
Modified
2026-10-22T17:00:04Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Electron: Pointer lock permission requests can be attributed to the wrong frame
Details

Impact

For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity.

Apps are only affected if they embed untrusted content in iframes and decide pointerLock requests by origin in setPermissionRequestHandler. Apps that do not embed untrusted content, or that deny pointerLock for it, are not affected.

Workarounds

Deny the pointerLock permission for web contents that embed untrusted frames.

Fixed Versions

  • 45.0.0-alpha.13
  • 44.5.0
  • 43.7.6
  • 42.11.9

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Database specific 
{
    "cwe_ids":  [
        "CWE-346"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-22T16:47:15Z",
    "nvd_published_at":  "2026-10-21T17:18:24Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / electron

Package

Name
electron
View open source insights on deps.dev
Purl
pkg:npm/electron

Affected ranges

Type
SEMVER
Events
Introduced
45.0.0-alpha.1
Fixed
45.0.0-alpha.13

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x562-297c-g43g/GHSA-x562-297c-g43g.json"

npm / electron

Package

Name
electron
View open source insights on deps.dev
Purl
pkg:npm/electron

Affected ranges

Type
SEMVER
Events
Introduced
44.0.0-alpha.1
Fixed
44.5.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x562-297c-g43g/GHSA-x562-297c-g43g.json"

npm / electron

Package

Name
electron
View open source insights on deps.dev
Purl
pkg:npm/electron

Affected ranges

Type
SEMVER
Events
Introduced
43.0.0-alpha.1
Fixed
43.7.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x562-297c-g43g/GHSA-x562-297c-g43g.json"

npm / electron

Package

Name
electron
View open source insights on deps.dev
Purl
pkg:npm/electron

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
42.11.9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-x562-297c-g43g/GHSA-x562-297c-g43g.json"