PT-2026-30007 · Electron · Electron

Published 2026-04-03 · Updated 2026-04-04 · CVE-2026-34777

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Electron versions prior to 38.8.6, 39.8.1, 40.8.1, and 41.0.0

Description Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin instead of the requesting iframe's origin. Applications that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content. The correct requesting URL is available via details.requestingUrl. Applications that already check details.requestingUrl are not affected.

Recommendations Update to Electron version 38.8.6 or later. Update to Electron version 39.8.1 or later. Update to Electron version 40.8.1 or later. Update to Electron version 41.0.0 or later. Inspect details.requestingUrl rather than the origin parameter or webContents.getURL() when deciding whether to grant fullscreen, pointerLock, keyboardLock, openExternal, or media permissions.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-34777

GHSA-R5P7-GP4J-QHRX

Affected Products

Electron

References · 6

• https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34777 · Security Note
• https://osv.dev/vulnerability/GHSA-r5p7-gp4j-qhrx · Vendor Advisory
• https://github.com/electron/electron · Note
• https://twitter.com/CVEnew/status/2040481262373359915 · Twitter Post
• https://twitter.com/infoflowcloud/status/2040482388833177858 · Twitter Post