Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-k7gj-cczw-wfeb
Vulnerability ID VCID-k7gj-cczw-wfeb
Aliases CVE-2026-34777
GHSA-r5p7-gp4j-qhrx
Summary Electron: Incorrect origin passed to permission request handler for iframe requests ### Impact When an iframe requests `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions, the origin passed to `session.setPermissionRequestHandler()` was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter or `webContents.getURL()` may inadvertently grant permissions to embedded third-party content. The correct requesting URL remains available via `details.requestingUrl`. Apps that already check `details.requestingUrl` are not affected. ### Workarounds In your `setPermissionRequestHandler`, inspect `details.requestingUrl` rather than the origin parameter or `webContents.getURL()` when deciding whether to grant `fullscreen`, `pointerLock`, `keyboardLock`, `openExternal`, or `media` permissions. ### Fixed Versions * `41.0.0` * `40.8.1` * `39.8.1` * `38.8.6` ### For more information If there are any questions or comments about this advisory, please email [security@electronjs.org](mailto:security@electronjs.org)
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-346 Origin Validation Error
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34777.json
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 5e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 5e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 5e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
epss 6e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34777
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-r5p7-gp4j-qhrx
cvssv3.1 5.4 https://github.com/electron/electron
generic_textual MODERATE https://github.com/electron/electron
cvssv3.1 5.4 https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx
cvssv3.1_qr MODERATE https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx
generic_textual MODERATE https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx
ssvc Track https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2026-34777
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-34777
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34777.json
https://api.first.org/data/v1/epss?cve=CVE-2026-34777
https://github.com/electron/electron
https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx
https://nvd.nist.gov/vuln/detail/CVE-2026-34777
2455022 https://bugzilla.redhat.com/show_bug.cgi?id=2455022
GHSA-r5p7-gp4j-qhrx https://github.com/advisories/GHSA-r5p7-gp4j-qhrx
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34777.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/electron/electron
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-06T15:32:48Z/ Found at https://github.com/electron/electron/security/advisories/GHSA-r5p7-gp4j-qhrx
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-34777
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.02646
EPSS Score 0.00014
Published At April 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-03T21:42:25.123195+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r5p7-gp4j-qhrx/GHSA-r5p7-gp4j-qhrx.json 38.1.0