CVE-2026-34766：Electron USB设备选择验证漏洞 (≤38.8.6)

CVE-2026-34766 影响 Electron 中通过 WebUSB 处理 USB 设备的方式。具体来说，select-usb-device 事件的回调函数没有正确验证所选设备 ID 是否与呈现给处理程序的过滤列表匹配。这允许能够影响处理程序的恶意应用程序选择一个与渲染器请求的 filters 不匹配或在 exclusionFilters 列表中列出的设备 ID。虽然 WebUSB 安全阻止列表仍然生效，从而保护了敏感设备，但此漏洞允许访问不需要的设备。

Applications built with Electron that implement custom WebUSB device selection logic are at the highest risk. This includes applications that allow users to select devices from a list or dynamically configure device filters. Developers using older Electron versions and those who haven't reviewed their device selection code are also at increased risk.

• nodejs / supply-chain: Monitor Electron application processes for unusual USB device access patterns. Use Get-Process in PowerShell to check for Electron processes with unexpected device handles.

Get-Process | Where-Object {$_.ProcessName -like "electron*"} | ForEach-Object {
  Get-Process -Id $_.Id | Select-Object DeviceHandles
}

• linux / server: Examine system logs (journalctl) for errors or warnings related to WebUSB device access. Filter for messages containing "WebUSB" or "select-usb-device".

journalctl | grep "WebUSB" -i

1. 2026-04-03Disclosure

   disclosure

1. 已保留2026-03-30
2. 发布日期2026-04-03
3. 修改日期2026-04-06
4. EPSS 更新日期2026-04-11

此漏洞的修复方法是更新到 Electron 版本 38.8.6 或更高版本。此更新实施了对所选设备 ID 的更严格验证，确保其与指定的过滤器匹配。强烈建议开发人员尽快更新其 Electron 应用程序以降低此风险。此外，请检查您的代码，查找攻击者可能能够影响设备选择的潜在入口点。