Electron's HID and USB permission checks incorrectly report the top‑level frame’s origin when invoked from an iframe, allowing a cross‑origin frame to gain device access that the application intended only for the main page. This flaw constitutes an information‑leak weakness (CWE‑346) that can lead to implicit privilege escalation within the host application.

Desktop applications built with Electron versions older than 42.11.3, 43.7.0, 44.3.0, or 45.0.0‑alpha.5 are affected. The vulnerability arises when the application delegates HID or USB access to a cross‑origin iframe, relying on the framework’s origin‑based permission checks.

The CVSS score of 5.4 indicates a moderate impact. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector is an application that embeds a cross‑origin iframe capable of injecting malicious JavaScript; this is inferred because the CVE description does not explicitly describe the injection method, but a malicious iframe is required to trigger the incorrect origin attribution. Once present, the attacker can receive privileged access to HID or USB devices, effectively bypassing the app’s origin‑based permission logic. Exploitation requires that the parent application delegate hardware access to the iframe without additional safeguards.