CVE-2026-70604

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.10 Electron versions prior to 40.9.3 Electron versions prior to 41.4.0 Electron versions prior to 42.0.0

Description A custom scheme registered with supportFetchAPI: true but without corsEnabled: true does not enforce Cross-Origin Resource Sharing (CORS), a security mechanism that restricts web pages from making requests to a different domain than the one that served the page. Consequently, a page loaded from a remote origin can use fetch() or XMLHttpRequest to access that scheme cross-origin and read the full response body. This affects applications that serve sensitive data via such a scheme and load remote or untrusted content in a renderer.

Recommendations Update to version 39.8.10. Update to version 40.9.3. Update to version 41.4.0. Update to version 42.0.0. Set corsEnabled: true on schemes that must enforce CORS and validate the request Origin in the protocol handler before returning sensitive data.