Security fix · CVE-2026-113798

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS.

Q: Which versions are affected?

Compare what you have installed with = 43.0.0-alpha.1, = 44.0.0-alpha.1, = 45.0.0-alpha.1, < 45.0.0-alpha.13. Compare the installed version with the linked vendor advisory before you change production.

Q: What should an analyst verify?

CWE-346. EPSS 0.24%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published Oct 21, 2026 · catalog updated Oct 28, 2026 · Electron is a framework

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-113798. EPSS is 0.24%. Act only if a listed version of Electron is a framework is installed.

Gaps on this record

The stored product name is a package slug. The name on this page is taken from the title (Electron is a framework).
No vendor fix or required action is stored. Compare the linked advisory before you change production.

Severity: Medium5.4
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: 0.24%
Remediation: Version ranges on file
Affected products: npm electron · package npm

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded content are not affected. This issue is fixed in versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

npm electron< 42.11.9
npm electron>= 43.0.0-alpha.1, < 43.7.6
npm electron>= 44.0.0-alpha.1, < 44.5.0
npm electron>= 45.0.0-alpha.1, < 45.0.0-alpha.13
package npmversion unspecified

How to fix CVE-2026-113798

Upgrade
CVE-2026-113798 lists a fix boundary at 42.11.9. Compare the installed build with that boundary before you change production.
Version check
Affected < 42.11.9
Advisory
Open the cve_org record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-113798. EPSS is 0.24%. Act only if a listed version of Electron is a framework is installed.

Which versions are affected?

Compare what you have installed with < 42.11.9, >= 43.0.0-alpha.1, < 43.7.6, >= 44.0.0-alpha.1, < 44.5.0, >= 45.0.0-alpha.1, < 45.0.0-alpha.13. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-346. EPSS 0.24%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 21, 2026 · NIST NVD
Detected
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An applicati
Oct 22, 2026 · GitHub Advisory Database
Updated
### Impact For permission requests made from some cross-origin iframes, was given the top-level frame's and instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity. Apps are only affected if they embed untrusted content in iframes and decide requests by origin in . Apps that do not embed u
Oct 28, 2026 · NIST NVD
Updated
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An applicati

Sources

CVE.orgVulnerability recordCVE-2026-113798
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2026-113798
30-day exploitation probability 0.24%
first.org
GitHub Advisory DatabasePackage advisoryGHSA-x562-297c-g43g
Electron: Pointer lock permission requests can be attributed to the wrong frame
github.com
GitLab Advisory DatabasePackage advisoryCVE-2026-113798
For pointerLock permission requests made from some cross-origin iframes, session.setPermissionRequestHandler() was given the top-level frame's requestingUrl and isMainFrame instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity. Apps are only affected if they embed untrusted content in if
advisories.gitlab.com
NIST NVDVulnerability recordCVE-2026-113798
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to r
nvd.nist.gov
Snyk Vulnerability DatabasePackage advisorySNYK-JS-ELECTRON-21431573
Origin Validation Error
security.snyk.io
Tenable CVE DatabaseVulnerability recordCVE-2026-113798
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An applicati
tenable.com

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

FIRST EPSSNov 6, 2026
Tenable CVE DatabaseOct 28, 2026
NIST NVDOct 28, 2026
Snyk Vulnerability DatabaseOct 25, 2026
GitHub Advisory DatabaseOct 23, 2026
GitLab Advisory DatabaseOct 23, 2026
CVE.orgOct 21, 2026

Priority score

9/100

Evidence confidence: High

Several independent sources name this vulnerability.

Confirmed exploitation0/30
EPSS probability1/20
CVSS severity8/15
Public exploit0/10
Internet exposure0/10
Product prevalence0/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Medium

CVSS severity
5.4 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
EPSS probability
0.24% · p15.40%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
No verified KEV listing
Evidence from CISA KEV or VulnCheck KEV only — not from EPSS alone.
Patch availability
Version ranges on file
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.

Stacks

npm

Weakness

CWE-346 MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.