ModerateVulnerabilityGHSA-fw47-9c62-h3vwCVE-2026-113800Published 21 Oct 2026

Electron: HID and USB permission checks can be attributed to the wrong origin

Affected releases · electron

44.x44.0.0 – 44.2.0Fixed in 44.3.0
43.x43.0.0 – 43.6.0Fixed in 43.7.0
42.x42.0.0 – 42.11.2Fixed in 42.11.3
41.x41.0.0 – 41.10.7No fix on this line yet
40.x40.0.0 – 40.10.6No fix on this line yet
39.x39.0.0 – 39.8.10No fix on this line yet
38.x38.0.0 – 38.8.6No fix on this line yet
37.x37.0.0 – 37.10.3No fix on this line yet
36.x and older0.1.0 – 36.9.5No fix, no longer updated

On 44.x, the newest line:

npm install electron@44.3.0

45.x

Not affected
45.0.0
1 release, latest

44.x

Affected
44.0.0 – 44.2.0
4 releases
Fixed
44.3.0 – 44.9.3
18 releases

43.x

Affected
43.0.0 – 43.6.0
10 releases
Fixed
43.7.0 – 43.8.3
16 releases

42.x

Affected
42.0.0 – 42.11.2
29 releases
Fixed
42.11.3 – 42.11.18
16 releases

41.x

Affected
41.0.0 – 41.10.7
32 releases

40.x

Affected
40.0.0 – 40.10.6
26 releases

39.x

Affected
39.0.0 – 39.8.10
31 releases

38.x

Affected
38.0.0 – 38.8.6
19 releases

37.x

Affected
37.0.0 – 37.10.3
24 releases

36.x

Affected
36.0.0 – 36.9.5
23 releases

35.x

Affected
35.0.0 – 35.7.5
22 releases

34.x

Affected
34.0.0 – 34.5.8
22 releases

33.x

Affected
33.0.0 – 33.4.11
21 releases

32.x

Affected
32.0.0 – 32.3.3
19 releases

31.x

Affected
31.0.0 – 31.7.7
19 releases

30.x

Affected
30.0.0 – 30.5.1
19 releases

29.x

Affected
29.0.0 – 29.4.6
20 releases

28.x

Affected
28.0.0 – 28.3.3
21 releases

27.x

Affected
27.0.0 – 27.3.11
25 releases

26.x

Affected
26.0.0 – 26.6.10
24 releases

25.x

Affected
25.0.0 – 25.9.8
26 releases

24.x

Affected
24.0.0 – 24.8.8
29 releases

23.x

Affected
23.0.0 – 23.3.13
25 releases

22.x

Affected
22.0.0 – 22.3.27
33 releases

21.x

Affected
21.0.0 – 21.4.4
18 releases

20.x

Affected
20.0.0 – 20.3.12
23 releases

19.x

Affected
19.0.0 – 19.1.9
28 releases

18.x

Affected
18.0.0 – 18.3.15
25 releases

17.x

Affected
17.0.0 – 17.4.11
20 releases

16.x

Affected
16.0.0 – 16.2.8
22 releases

15.x

Affected
15.0.0 – 15.5.7
24 releases

14.x

Affected
14.0.0 – 14.2.9
15 releases

13.x

Affected
13.0.0 – 13.6.9
29 releases

12.x

Affected
12.0.0 – 12.2.3
26 releases

11.x

Affected
11.0.0 – 11.5.0
27 releases

10.x

Affected
10.0.0 – 10.4.7
22 releases

9.x

Affected
9.0.0 – 9.4.4
22 releases

8.x

Affected
8.0.0 – 8.5.5
25 releases

7.x

Affected
7.0.0 – 7.3.3
26 releases

6.x

Affected
6.0.0 – 6.1.12
26 releases

5.x

Affected
5.0.0 – 5.0.13
14 releases

4.x

Affected
4.0.0 – 4.2.12
28 releases

3.x

Affected
3.0.0 – 3.1.13
31 releases

2.x

Affected
2.0.0 – 2.0.18
19 releases

1.x

Affected
1.3.1 – 1.8.8
79 releases

0.x

Affected
0.1.0 – 0.4.1
8 releases

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.

You're only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow="hid" or allow="usb". Apps that don't delegate those features to untrusted iframes are not affected.

Workarounds

Don't add allow="hid" / allow="usb" to untrusted iframes, or make the decision in your select-hid-device / select-usb-device handler using details.frame.

Fixed Versions

45.0.0-alpha.5
44.3.0
43.7.0
42.11.3

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org