GHSA-x562-297c-g43g Electron: Pointer lock permission requests can be attributed to the wrong frame

• npm electron: >= 45.0.0-alpha.1, < 45.0.0-alpha.13 → fixed in 45.0.0-alpha.13 • npm electron: >= 44.0.0-alpha.1, < 44.5.0 → fixed in 44.5.0 • npm electron: >= 43.0.0-alpha.1, < 43.7.6 → fixed in 43.7.6 • npm electron: < 42.11.9 → fixed in 42.11.9

Impact For `pointerLock` permission requests made from some cross-origin iframes, `session.setPermissionRequestHandler()` was given the top-level frame's `requestingUrl` and `isMainFrame` instead of the requesting frame's. Apps that grant pointer lock based on the requesting origin could grant it to embedded content under the top-level page's identity. Apps are only affected if they embed untrusted content in iframes and decide `pointerLock` requests by origin in `setPermissionRequestHandler`. Apps that do not embed untrusted content, or that deny `pointerLock` for it, are not affected. Workarounds Deny the `pointerLock` permission for web contents that embed untrusted frames. Fixed Versions • `45.0.0-alpha.13` • `44.5.0` • `43.7.6` • `42.11.9` For more information If you have any questions or comments about this advisory, email us at [email protected]