CVE-2026-34777

CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates network-accessible, low-complexity attack requiring user interaction but no privileges, with limited confidentiality and integrity impact and no availability impact. However, CVSS alone underrepresents real-world risk: the vulnerability requires both (1) a vulnerable Electron application that decides permissions based on origin rather than details.requestingUrl, and (2) user interaction to load a malicious iframe. The threat is application-specific-well-written apps checking details.requestingUrl are already protected. Exploitation automatable in scope (attacker can craft HTML/JavaScript), but technical impact is permission escalation within a single application context, not OS-level or multi-application compromise. EPSS and KEV data not provided; no public exploit code identified. Priority should be determined by inventory of Electron applications in use and their permission handler implementation patterns.

An attacker embeds a malicious iframe (e.g., <iframe src="https://attacker.com/steal-camera.html"></iframe>) into a trusted website or compromises a legitimate website to inject the iframe. When the attacker's frame requests media permission, the vulnerable Electron app's permission handler receives the top-level website's origin (e.g., trusteddomain.com) instead of attacker.com and grants access. The iframe can then record video and audio from the user's webcam and microphone without explicit consent for the attacker's origin. This requires user interaction (page load) but no special privileges, and succeeds against any Electron app that decides permissions by origin rather than details.requestingUrl.