CVE-2026-70604 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
A vulnerability exists in Electron prior to versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0. It involves custom schemes that are registered with supportFetchAPI enabled but without CORS enforcement. This flaw allows pages from remote origins to make cross-origin fetch or XMLHttpRequest calls to these custom schemes and access the full response body, bypassing the intended CORS restrictions. The issue affects applications that use such custom schemes to deliver sensitive data and load remote or untrusted content in a renderer.
To address this vulnerability, update to Electron versions 39.8.10, 40.9.3, 41.4.0, or 42.0.0. Additionally, for custom schemes that need to enforce CORS, set 'corsEnabled' to true and validate the 'Origin' header in the protocol handler before returning sensitive data.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |