Bug 2455022 (CVE-2026-34777) - CVE-2026-34777 Electron: Electron: Unauthorized permission granting and information disclosure via incorrect iframe origin
Summary: CVE-2026-34777 Electron: Electron: Unauthorized permission granting and infor...
Keywords:
Status: NEW
Alias: CVE-2026-34777
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2455444 2455445
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-04 01:01 UTC by OSIDB Bzimport
Modified: 2026-04-06 16:41 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-04 01:01:24 UTC 
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or webContents.getURL() may inadvertently grant permissions to embedded third-party content. The correct requesting URL remains available via details.requestingUrl. Apps that already check details.requestingUrl are not affected. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0.
Note You need to log in before you can comment on or make changes to this bug.