Electron versions prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0‑beta.1 triggered permission checks for serial‑port and media devices from iframes, but the handler received the top‑level frame’s origin instead of the requesting iframe’s origin. The resulting granularity loss meant that an iframe could be granted permissions intended only for the top‑level origin, enabling a privilege escalation that could expose device access to a foreign origin within the application. This flaw is an instance of imprecise access control (CWE‑346).

All Electron applications built with the affected framework versions that use serial‑port or media permission checks via iframes. The security update includes Electron 39.8.7, 40.9.0, 41.2.0, and 42.0.0‑beta.1; earlier builds remain vulnerable.

The CVSS score of 5.9 indicates a moderate risk; no EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be able to load a malicious iframe within the Electron application, which can be achieved through user‑controlled input or the application loading external content. The flaw does not provide remote code execution but permits unauthorized access to device permissions, thereby compromising confidentiality and integrity of the underlying device. The defender should consider the vulnerability as a medium‑to‑high risk for applications exposing serial‑port or media permissions to third‑party content.