CVE-2026-34771

Requires application to register an asynchronous session.setPermissionRequestHandler() callback. Victim must interact with fullscreen, pointer-lock, or keyboard-lock permission requests while the requesting frame navigates or window closes during pending handler execution. Synchronous handlers or missing handlers are not vulnerable.

The CVSS v3.1 score of 7.5 (High) reflects network-based attack vector (AV:N) with high attack complexity (AC:H), requiring user interaction (UI:R) but no privileges (PR:N), with potential for high confidentiality, integrity, and availability impact. However, real-world risk requires careful contextualization. The attack complexity is genuinely high because exploitation depends on precise timing: the attacker must trigger a permission request (fullscreen, pointer-lock, or keyboard-lock), then cause frame navigation or window closure during the narrow window when an asynchronous handler is pending. This is not trivially weaponizable compared to simpler vulnerabilities. No public exploit identified at time of analysis, and EPSS data is unavailable for risk quantification. The vulnerability affects only a subset of Electron applications-those specifically implementing asynchronous permission handlers for these three permission types. Many Electron apps either don't implement custom permission handlers or use synchronous responses. From an SSVC perspective: exploitation status is POC (proof-of-concept feasible but not public), automatable is no (requires user interaction and timing precision), technical impact is significant (memory corruption potential). Priority should be moderate for organizations running affected Electron apps with async permission handlers, but lower for apps using default permission behavior or synchronous handlers.

An attacker hosts a malicious website containing JavaScript that requests fullscreen permission (or pointer-lock/keyboard-lock) when a victim visits using an Electron-based application vulnerable to this issue and configured with an asynchronous permission handler. The malicious page simultaneously triggers rapid frame navigation or attempts to close the window using JavaScript immediately after requesting the permission. If the timing aligns correctly during the narrow window while the application's asynchronous permission handler is pending, the stored callback dereferences freed memory. This could crash the application or, with sophisticated heap manipulation, potentially allow the attacker to corrupt memory and execute arbitrary code within the application's security context.