HID and USB permission checks report the top‑level frame’s origin instead of the requesting iframe, letting a cross‑origin iframe receive device access that the application intended only for the main page. This flaw enables implicit privilege escalation within the host application.

Desktop applications built with Electron versions before 42.11.3, 43.7.0, 44.3.0, or 45.0.0‑alpha.5 are vulnerable if they delegate HID or USB access to a cross‑origin iframe.

The CVSS score of 5.4 indicates a moderate impact. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation evidence. The likely attack vector is an application that hosts a malicious cross‑origin iframe that can request HID or USB permissions; once triggered, the attacker may gain privileged access to hardware devices.