CVE-2026-34766

Electron's WebUSB API implementation includes a device selection mechanism that presents users with a filtered list of USB devices based on the renderer process's requested filters and exclusion filters. The vulnerability exists in the select-usb-device event callback handler, which failed to validate that the device ID ultimately selected by the user matched the original filtered device set presented to them. This represents a missing authorization check (CWE-862: Missing Authorization) where the main process accepted a device selection without re-verifying it against the declared filter constraints. While the WebUSB security blocklist-a hardcoded list of security-sensitive devices like FIDO keys-remained enforced at a lower layer, the filter bypass allows access to devices outside the originally requested scope. The npm package 'electron' across multiple major versions contained this validation gap in its USB device enumeration and selection logic.