Electron applications that host cross‑origin iframes could be tricked into granting pointer lock permission to an untrusted frame under the identity of the top‑level page. The framework’s session.setPermissionRequestHandler receives the top‑level frame’s URL and main frame flag instead of the requesting iframe’s values, allowing an attacker to obtain pointer lock as if they were the parent page. This results in an unauthorized privilege elevation within the application, potentially leading to denial of service or malicious user input capture. The weakness is classified as CWE‑346, "Information Exposure Through Inadequate Access Control".

Electron version 42.11.9 and all later releases are safe; every Electron release prior to 42.11.9, 43.7.6, 44.5.0, and 45.0.0‑alpha.13 is vulnerable. The vulnerability affects Electron applications using session.setPermissionRequestHandler to control pointer lock permissions, regardless of the hosting platform.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Nonetheless, the attack can be carried out from within an application that embeds untrusted iframes and grants pointer lock based on request origin. An attacker can host a malicious iframe and rely on the incorrect attribution to obtain pointer lock privileges that the host application would otherwise restrict.