CVE-2026-70604
Received Received - Intake

Electron Custom Scheme CORS Bypass Vulnerability

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-70604
EUVD
EUVD-2026-53440

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
electron electron to 39.8.10 (inc)
electron electron to 40.9.3 (inc)
electron electron to 41.4.0 (inc)
electron electron to 42.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Electron allows a remote page to bypass CORS restrictions when fetching data from a custom scheme configured with supportFetchAPI true but without corsEnabled true. This means sensitive data served from such schemes could be read by untrusted remote content.

Detection Guidance

Check if your Electron app uses custom schemes with supportFetchAPI: true but without corsEnabled: true. Inspect network requests in developer tools for cross-origin fetch or XMLHttpRequest calls to such schemes. Look for untrusted remote content loaded in renderers.

Impact Analysis

If you use an affected Electron version to serve sensitive data via a custom scheme while loading untrusted remote content, attackers could exploit this to steal that data through cross-origin fetch or XMLHttpRequest calls.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) by exposing confidential information to unauthorized parties.

Mitigation Strategies

Upgrade Electron to a patched version (39.8.10, 40.9.3, 41.4.0, or 42.0.0 or later). Ensure custom schemes have corsEnabled: true if supportFetchAPI is enabled. Avoid loading untrusted remote content in renderers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart