Red Hat CVE-2026-34766

This vulnerability presents low real-world risk despite affecting a widely-used framework. The CVSS 3.3 score reflects the limited attack surface: local attack vector (AV:L), high complexity (AC:H), authenticated user requirement (PR:L), and mandatory user interaction (UI:R) create substantial friction for exploitation. The symmetric impact (C:L, I:L, A:N) indicates the attacker gains limited confidentiality and integrity access without availability impact. The authentication requirement (PR:L) and UI interaction constraint mean exploitation requires either a compromised local user account or social engineering to manipulate the UI element. The description explicitly states the practical impact is limited to applications with unusual device-selection logic, suggesting this is not a general-purpose bypass affecting typical WebUSB usage. The fact that the security blocklist remains enforced is a critical mitigating control-devices most sensitive to unauthorized access (FIDO keys, security tokens) cannot be accessed via this bypass. No EPSS score, KEV status, or POC availability data was provided, but the constraint profile (local + authenticated + UI interaction + limited scope) suggests this is unlikely to be actively exploited in the wild; however, it remains a valid bypass in targeted scenarios where an attacker has local access and can influence application UI behavior.

An attacker with local access to a system running a vulnerable Electron application could craft a scenario where the application's device selection UI is presented to a user (e.g., a browser requesting USB access for a peripheral). By manipulating the selection mechanism or exploiting application-specific device selection logic, the attacker influences the handler to select a device ID that was not in the originally filtered list, thereby gaining access to a USB device that should have been restricted by the application's exclusion filters. This requires the attacker to either compromise a local user account or perform UI-level social engineering, making it a targeted attack rather than a mass exploitation vector.