The flaw causes Electron to pass the top‑level page’s origin instead of the iframe’s origin when a fullscreen, pointer lock, keyboard lock, open external, or media request is made. Applications that grant permissions based on the origin parameter or the result of webContents.getURL() may therefore incorrectly grant elevated rights to third‑party iframe content. The mistake enables the application to give sensitive privileges to embedded sites without the user’s explicit consent.

Electron framework releases prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0 are affected. Developers who have built desktop applications with those releases and who rely on origin‑based permission checks are within scope. The issue pertains exclusively to the Electron:electron product and does not involve other vendors’ software.

The vulnerability has a CVSS score of 5.4, indicating moderate severity. No EPSS score is provided and the flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to supply or control an iframe within the application and rely on the application’s permission handling logic. If the application correctly checks the details.requestingUrl field, the vulnerability is effectively mitigated. Therefore, the practical risk is moderate when such checks are in place, but higher if the application grants based on the incorrect origin.