CVE-2026-113798
Description
A flaw was found in Electron. When an embedded cross-origin iframe requests pointer lock, the permission handler incorrectly identifies the request as originating from the top-level frame. A remote attacker who supplies untrusted embedded web content can exploit this vulnerability to obtain pointer lock permissions under the trusted application's identity.
Statement
This vulnerability is evaluated as Moderate impact because successful exploitation requires user interaction to load untrusted embedded content and specifically depends on an application delegating pointer lock based on origin checks. Under these conditions, a malicious iframe can capture mouse pointer control by inheriting top-level permissions, but the flaw does not grant unauthorized file access, data exfiltration, or code execution. Electron is not distributed in Red Hat Enterprise Linux, meaning standard Red Hat environments are not directly exposed.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
