CVE-2026-34766
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In Electron before versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, the select-usb-device event callback does not validate the chosen device ID against the filtered list. An app whose handler can be influenced to select a device outside the filtered set may grant access to an unauthorized USB device.
Risk Assessment
Apps with custom device selection logic may inadvertently grant access to devices that should not be accessible, potentially leading to data leakage or unauthorized access.
Recommendation
Update Electron to version 38.8.6, 39.8.0, 40.7.0, or 41.0.0-beta.8.
Original NVD description (English source)
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, the select-usb-device event callback did not validate the chosen device ID against the filtered list that was presented to the handler. An app whose handler could be influenced to select a device ID outside the filtered set would grant access to a device that did not match the renderer's requested filters or was listed in exclusionFilters. The WebUSB security blocklist remained enforced regardless, so security-sensitive devices on the blocklist were not affected. The practical impact is limited to apps with unusual device-selection logic. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.