CVE-2026-102675: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
Impact
Responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI: true but without corsEnabled: true could be read cross-origin by web content. This completes the fix for CVE-2026-70604.
Apps are only affected if they register such a scheme, serve it through one of those handlers, and load untrusted content. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.
Workarounds
Set corsEnabled: true on the scheme, or do not load untrusted content in windows that can reach it.
Fixed Versions
44.0.0-beta.5 43.4.1 42.9.2 41.10.6
For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 44.0.0-beta.5 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.4.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.9.2 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.10.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 41.10.6 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.9.2 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.4.1 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.0.0-beta.5 - Configuration
Set corsEnabled: true on the custom scheme.
Electron custom scheme corsEnabled = true - Compensating control
Do not load untrusted content in windows that can reach the custom scheme.
Event History
Frequently Asked Questions
Which Electron applications are actually affected?
An application is affected only if it exposes a custom scheme using protocol.registerFileProtocol or protocol.registerHttpProtocol, registers that scheme with supportFetchAPI enabled and corsEnabled disabled, and loads untrusted content in the same session.
What must an attacker be able to do?
The attacker needs untrusted content to be loaded in the same Electron session as the affected custom scheme. Under that condition, script can read responses from the scheme across origins.
Are schemes with corsEnabled enabled vulnerable?
Such schemes remain cross-origin readable by design. The issue concerns schemes configured with supportFetchAPI enabled while corsEnabled is disabled.
Which releases contain the fix?
The issue is fixed in Electron 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.