CVE-2026-70604
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.4
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
- EPSS probability
- 0.28%
- CWE
- CWE-942
- Published
- 2026-08-05
- Last modified
- 2026-08-05
Affected products
- electron electron
- electron electron
- electron electron
- electron electron
Weakness type
Related vulnerabilities
- CVE-2026-62895 — Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
- CVE-2026-12962 — A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote...
- CVE-2026-84452 — Windows ML CLI: CORS misconfig enables localhost RCE
- CVE-2026-53649 — Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
- CVE-2026-82291 — HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
- CVE-2026-82287 — Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials
- CVE-2026-53656 — FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
- CVE-2026-63407 — Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses