#53656: fix: report the requesting frame for hid and usb permission checks
Merged
Created: Sep 7, 2026, 2:22:12 AM
Merged: Sep 7, 2026, 10:45:52 AM
6 comments
Target: main
Description of Change
Supersedes #53629 (split: this is the narrow fix; the wider per-frame device permission work is in the follow-up PR stacked on this branch).
ElectronHidDelegate/ElectronUsbDelegateran thehid/usbpermission check with a null frame and the origin content handed them, sosession.setPermissionCheckHandlersaw the top-level document's origin, norequestingUrl,isMainFrame: falseand a nullwebContentsfor a check made from a subframe — while the chooser controllers already store the grant under the requesting frame's origin. Serial and media were fixed for the same thing in #50679.- Carries https://crrev.com/c/8364427 so
CanRequestDevicePermission()receives the frame, keysHidService/WebUsbServiceImplon the requesting frame's origin so grant, check andforget()agree, and passes the frame intoCheckPermissionWithDetails. - Specs:
hid/usbcheck from a cross-origin iframe reports the iframe's origin, URL,isMainFrame: falseand the owningwebContents.
Checklist
- PR description included and stakeholders cc'd
-
npm testpasses - tests are changed or added
- relevant documentation is changed or added
Release Notes
Notes: Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe.
Backports
Semver Impact
Major
Breaking changes
Minor
New features
Patch
Bug fixes
None
Docs, tests, etc.
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron