CVE-2026-70604 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
A vulnerability exists in Electron prior to versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0. It involves custom schemes that are registered with supportFetchAPI enabled but without CORS enforcement. This flaw allows pages from remote origins to make cross-origin fetch or XMLHttpRequest calls to these custom schemes and access the full response body, bypassing the intended CORS restrictions. The issue affects applications that use such custom schemes to deliver sensitive data and load remote or untrusted content in a renderer.
To address this vulnerability, update to Electron versions 39.8.10, 40.9.3, 41.4.0, or 42.0.0. Additionally, for custom schemes that need to enforce CORS, set 'corsEnabled' to true and validate the 'Origin' header in the protocol handler before returning sensitive data.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| electronjs electron | < 39.8.10 >= 40.0.0, < 40.9.3 >= 41.0.0, < 41.4.0 42.0.0 alpha1 42.0.0 alpha2 42.0.0 alpha3 42.0.0 alpha4 42.0.0 alpha5 42.0.0 alpha6 42.0.0 beta1 42.0.0 beta2 42.0.0 beta3 42.0.0 beta4 42.0.0 beta5 42.0.0 beta6 42.0.0 beta7 42.0.0 beta8 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |