CVE-2026-113798

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded content are not affected. This issue is fixed in versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13.

• CWE-346

• https://github.com/electron/electron/commit/076c7496791a45968cf8d9e76e9657bc161ea979
• https://github.com/electron/electron/commit/0b680cfa1ffa70a50282da53efde37a210d5223b
• https://github.com/electron/electron/commit/1755ee598697356959219beefee1e139bc3f8207
• https://github.com/electron/electron/commit/4073e9f4712f61e6b8abd5548673cc7638f6c1a1
• https://github.com/electron/electron/commit/a48e6eaaafa85b6fc40f7431ceec4fd6ef4bb899
• https://github.com/electron/electron/pull/54432
• https://github.com/electron/electron/pull/54463
• https://github.com/electron/electron/pull/54464
• https://github.com/electron/electron/pull/54465
• https://github.com/electron/electron/pull/54466
• https://github.com/electron/electron/releases/tag/v42.11.9
• https://github.com/electron/electron/releases/tag/v43.7.6
• https://github.com/electron/electron/releases/tag/v44.5.0
• https://github.com/electron/electron/releases/tag/v45.0.0-alpha.13
• https://github.com/electron/electron/security/advisories/GHSA-x562-297c-g43g

Published

Oct 21, 2026

Last Modified

Oct 21, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113792pypdf is a free and open-source pure-python PDF library. Pri…6
• CVE-2026-113793pypdf is a free and open-source pure-python PDF library. Pri…6
• CVE-2026-113794pypdf is a free and open-source pure-python PDF library. Pri…6
• CVE-2026-113795pypdf is a free and open-source pure-python PDF library. Pri…6
• CVE-2026-113796Electron is a framework for writing cross-platform desktop a…4.2
• CVE-2026-113797Electron is a framework for writing cross-platform desktop a…3.1
• CVE-2026-113799Slack Morphism is a client library for Slack Web/Events API/…5.3
• CVE-2026-1138A flaw has been found in UTT 进取 520W 1.7.7-180627. This affe…8.8
• CVE-2026-11380The JetWidgets For Elementor plugin for WordPress is vulnera…6.4
• CVE-2026-113800Electron is a framework for writing cross-platform desktop a…5.4
• CVE-2026-113802Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contai…9.8
• CVE-2026-113808A Stored Cross-Site Scripting vulnerability exists in the SN…7.1