CVE-2026-70604: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads
Impact A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked.
Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.
Workarounds Set corsEnabled: true on schemes that must enforce CORS, and validate the request Origin in your protocol handler before returning sensitive data.
Fixed Versions 42.0.0 41.4.0 40.9.3 39.8.10
For more information If you have any questions or comments about this advisory, email Electron at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.10 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.4.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 39.8.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 40.9.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 41.4.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 42.0.0 - Configuration
For any custom scheme registered with supportFetchAPI: true that must enforce CORS, set corsEnabled: true.
Electron custom protocol scheme registration corsEnabled = true - Configuration
In the protocol handler, validate the request Origin before returning sensitive data.
Electron protocol handler Origin validation = validate request Origin before returning sensitive data
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70604?
The severity of CVE-2026-70604 is classified as high, with a CVSS score of 7.4.
What is the impact of CVE-2026-70604?
CVE-2026-70604 allows a custom scheme to be accessed cross-origin without CORS enforcement, potentially exposing sensitive data.
How do I fix CVE-2026-70604?
To fix CVE-2026-70604, ensure that any custom schemes use 'corsEnabled: true' along with 'supportFetchAPI: true'.
Which software is affected by CVE-2026-70604?
CVE-2026-70604 affects the Electron framework, specifically versions that utilize custom schemes.
Is CVE-2026-70604 a critical vulnerability?
CVE-2026-70604 is considered high risk but is not rated as critical due to specific exploitation requirements.