CyberRota Analysis
AI-GeneratedThe vulnerability affects Electron framework versions prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, where improper handling of permission checks allows a cross-origin iframe to gain unauthorized access to device resources intended for the top-level origin. This could lead to potential data exposure or manipulation by malicious iframes. Developers and organizations using affected versions of Electron should prioritize updating to the fixed versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin. This issue is fixed in 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1.