Electron’s select-usb-device event callback failed to verify that the selected device ID matched the list of devices presented to the handler, allowing an application to access any USB device that passed the WebUSB blocklist but was not included in the filtered set; this flaw gives the app unauthorized access to USB peripherals but does not enable code execution or broader system compromise.

All Electron releases prior to 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8 are affected, covering versions 38.8.x before 38.8.6, 39.8.x before 39.8.0, 40.7.x before 40.7.0, and every beta before 41.0.0-beta.8; the vulnerability is confined to the Electron framework and does not impact earlier operating systems.

The CVSS score of 3.3 indicates low severity, and with an EPSS below one percent the likelihood of exploitation is very low; it is not listed in the CISA KEV catalog, and because the flaw requires manipulation of the application’s own USB selection logic it is not remotely exploitable from outside the app, limiting the risk to software that improperly handles device selection.