Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads (CVE-2026-70604)
A vulnerability in Electron allows cross-origin reads from custom protocols that have supportFetchAPI enabled but lack CORS enforcement. This flaw permits remote-origin pages to fetch or XMLHttpRequest such schemes and read full response bodies without CORS restrictions. Applications serving sensitive data via such custom schemes and loading untrusted content are at risk. The issue is fixed in Electron versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
AI Analysis
Technical Summary
Electron versions prior to 39.8.10 contain a vulnerability (CVE-2026-70604) where custom schemes registered with supportFetchAPI set to true but without corsEnabled set to true do not enforce CORS policies. This allows a page loaded from a remote origin to perform fetch or XMLHttpRequest calls to these custom schemes cross-origin and read the entire response body, bypassing intended CORS restrictions. The vulnerability affects applications that serve sensitive data from such schemes and load remote or untrusted content in a renderer. Setting corsEnabled to true or avoiding loading untrusted content mitigates the risk. The issue is addressed in Electron versions 39.8.10 and later.
Potential Impact
Remote web content can bypass CORS enforcement on custom Electron protocols with supportFetchAPI enabled but corsEnabled disabled, allowing unauthorized cross-origin reads of sensitive data served by these protocols. This can lead to data exposure without requiring user privileges or authentication. The vulnerability does not impact applications that enable corsEnabled or do not load untrusted content in the renderer.
Mitigation Recommendations
A fix is available in Electron versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0. Users should upgrade to one of these versions or later. As a workaround, set corsEnabled: true on custom schemes that require CORS enforcement and validate the Origin header in the protocol handler before returning sensitive data. Applications that do not load untrusted content are not affected.
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads (CVE-2026-70604)
Description
A vulnerability in Electron allows cross-origin reads from custom protocols that have supportFetchAPI enabled but lack CORS enforcement. This flaw permits remote-origin pages to fetch or XMLHttpRequest such schemes and read full response bodies without CORS restrictions. Applications serving sensitive data via such custom schemes and loading untrusted content are at risk. The issue is fixed in Electron versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
CVSS v3.1
Score 7.4high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Electron versions prior to 39.8.10 contain a vulnerability (CVE-2026-70604) where custom schemes registered with supportFetchAPI set to true but without corsEnabled set to true do not enforce CORS policies. This allows a page loaded from a remote origin to perform fetch or XMLHttpRequest calls to these custom schemes cross-origin and read the entire response body, bypassing intended CORS restrictions. The vulnerability affects applications that serve sensitive data from such schemes and load remote or untrusted content in a renderer. Setting corsEnabled to true or avoiding loading untrusted content mitigates the risk. The issue is addressed in Electron versions 39.8.10 and later.
Potential Impact
Remote web content can bypass CORS enforcement on custom Electron protocols with supportFetchAPI enabled but corsEnabled disabled, allowing unauthorized cross-origin reads of sensitive data served by these protocols. This can lead to data exposure without requiring user privileges or authentication. The vulnerability does not impact applications that enable corsEnabled or do not load untrusted content in the renderer.
Mitigation Recommendations
A fix is available in Electron versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0. Users should upgrade to one of these versions or later. As a workaround, set corsEnabled: true on custom schemes that require CORS enforcement and validate the Origin header in the protocol handler before returning sensitive data. Applications that do not load untrusted content are not affected.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v3j7-r9gq-3gjw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70604"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a73851ebf8831d5394ef7d9
Added to database: 08/05/2026, 18:46:54 UTC
Last enriched: 08/05/2026, 19:12:03 UTC
Last updated: 08/05/2026, 19:12:03 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.