Search: CVE-2026-70604

A vulnerability in Electron allows cross-origin reads from custom protocols that have supportFetchAPI enabled but lack CORS enforcement. This flaw permits remote-origin pages to fetch or XMLHttpRequest such schemes and read full response bodies without CORS restrictions. Applications serving sensitive data via such custom schemes and loading untrusted content are at risk. The issue is fixed in Electron versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.