Electron: Pointer lock permission requests can be attributed to the wrong frame

Impact For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedd...

GHSA-X562-297C-G43G Electron: Pointer lock permission requests can be attributed to the wrong frame

Impact For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedd...

EUVD-2026-107374

Electron: Pointer lock permission requests can be attributed to the wrong frame...

Origin Validation Error

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error via misattribution of pointerLock permission requests from in-process iframes. When a same-site,...

Origin Validation Error

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error via misattribution of pointerLock permission requests from in-process iframes. When...

SUSE CVE-2026-113798

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler to receive the top-leve...

CVE-2026-113798

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler to receive the top-leve...

CVE-2026-113798 Electron: Pointer lock permission requests can be attributed to the wrong frame

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler to receive the top-leve...

CVE-2026-113798

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler to receive the top-leve...

CVE-2026-113798 Electron: Pointer lock permission requests can be attributed to the wrong frame

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler to receive the top-leve...

CVE-2026-113798

The Electron framework is vulnerable to an Origin Validation Error (CWE-346) in versions prior to 42.11.9 , 43.7.6 , 44.5.0 , and 45.0.0-alpha.13 . The root cause is that pointerLock permission requests from certain cross-origin iframes incorrectly cause session.setPermissionRequestHandler() to r...

CVE-2026-113798 Electron: Pointer lock permission requests can be attributed to the wrong frame

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler to receive the top-leve...

PT-2026-120674

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.9 Electron versions prior to 43.7.6 Electron versions prior to 44.5.0 Electron versions prior to 45.0.0-alpha.13 Description Pointer lock permission requests originating from certain cross-origin iframes cause...

ROS-20260915-73-0060

The vulnerability of the PointerLock component in Microsoft Edge and Google Chrome is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to replace the user interface with a specially created HTML page...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

PointerLock Component XSS

The vulnerability of the PointerLock component in Microsoft Edge and Google Chrome is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to replace the user interface through a specially created HTML page...

CVE-2026-11221

An insufficient validation of untrusted input flaw was found in the PointerLock component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=492211919...

Chromium: CVE-2026-11221 Insufficient validation of untrusted input in PointerLock

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2026-34682

Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-11221

Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...