Electron EUVD-2026-53428

Exploitation requires all three of the following conditions simultaneously: (1) the Electron application installs a session.setPermissionCheckHandler that makes grant or deny decisions based on the requestingOrigin parameter - applications that base decisions on details.securityOrigin are explicitly not affected; (2) the application embeds at least one cross-origin iframe, meaning an iframe whose committed origin differs from the top-level page's origin; and (3) that cross-origin iframe is granted delegated device permissions for serial port, camera, or microphone access via Permissions Policy (e.g., the iframe allow attribute includes camera, microphone, or serial). If any single condition is absent the application is not vulnerable. These preconditions align with the CVSS AC:H rating and the vendor's explicit scope statement. Limiting factors: requires a specific, non-default application architecture; does not affect Electron apps that use details.securityOrigin, that do not embed cross-origin iframes, or that do not delegate device permissions to iframes.

The CVSS 5.9 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately models this vulnerability. AC:H is justified by the three concurrent preconditions required for exploitation (see exploitation_conditions). C:H is appropriate given that camera, microphone, and serial device access constitute high-sensitivity data streams. No EPSS score was included in the source data, so exploitation probability cannot be quantified beyond CVSS signals. KEV status is not confirmed and no public POC has been identified - these signals together suggest this has not yet been weaponized at scale. Real-world risk is meaningful for high-value Electron applications (chat clients, IDEs, collaboration tools) that embed third-party iframe content with media delegation, but the vendor's explicit scope limitation - apps not using origin-based handler logic or not embedding such iframes are unaffected - substantially narrows the exposed population. No conflicting signals are present in the available data.

An attacker who controls content served from a cross-origin domain is embedded as an iframe inside a trusted Electron application (for example, a third-party analytics widget or help-center panel). The app's setPermissionCheckHandler grants camera access when requestingOrigin matches the trusted top-level origin; because the bug causes Electron to forward the top-level origin for the iframe's media request, the handler approves it. The attacker's iframe silently gains camera or microphone access without holding the trusted origin, enabling audio/video capture of the user's environment.