Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-r7j1-66md-zkak
Vulnerability ID VCID-r7j1-66md-zkak
Aliases CVE-2026-34766
GHSA-9899-m83m-qhpj
Summary Electron: USB device selection not validated against filtered device list ### Impact The `select-usb-device` event callback did not validate the chosen device ID against the filtered list that was presented to the handler. An app whose handler could be influenced to select a device ID outside the filtered set would grant access to a device that did not match the renderer's requested `filters` or was listed in `exclusionFilters`. The WebUSB security blocklist remained enforced regardless, so security-sensitive devices on the blocklist were not affected. The practical impact is limited to apps with unusual device-selection logic. ### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ### Fixed Versions * `41.0.0-beta.8` * `40.7.0` * `39.8.0` * `38.8.6` ### For more information If there are any questions or comments about this advisory, send an email to [security@electronjs.org](mailto:security@electronjs.org)
Status Published
Exploitability 0.5
Weighted Severity 3.0
Risk 1.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-862 Missing Authorization
CWE-1289 Improper Validation of Unsafe Equivalence in Input
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 3.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34766.json
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-34766
cvssv3.1_qr LOW https://github.com/advisories/GHSA-9899-m83m-qhpj
cvssv3.1 3.3 https://github.com/electron/electron
generic_textual LOW https://github.com/electron/electron
cvssv3.1 3.3 https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj
cvssv3.1_qr LOW https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj
generic_textual LOW https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj
ssvc Track https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj
cvssv3.1 3.3 https://nvd.nist.gov/vuln/detail/CVE-2026-34766
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2026-34766
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34766.json
https://api.first.org/data/v1/epss?cve=CVE-2026-34766
https://github.com/electron/electron
https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj
https://nvd.nist.gov/vuln/detail/CVE-2026-34766
2454998 https://bugzilla.redhat.com/show_bug.cgi?id=2454998
GHSA-9899-m83m-qhpj https://github.com/advisories/GHSA-9899-m83m-qhpj
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34766.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/electron/electron
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N Found at https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-06T19:07:01Z/ Found at https://github.com/electron/electron/security/advisories/GHSA-9899-m83m-qhpj
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-34766
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01291
EPSS Score 0.00011
Published At April 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-03T21:42:26.035527+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9899-m83m-qhpj/GHSA-9899-m83m-qhpj.json 38.1.0