Threats tagged 'ghsa-j84w-jfhq-vhvj'

Electron versions prior to 41.10.6, between 42.0.0-alpha.1 and 42.9.2, between 43.0.0-alpha.1 and 43.4.1, and between 44.0.0-alpha.1 and 44.0.0-beta.5 have a vulnerability where file and HTTP protocol handlers allow cross-origin reads without the corsEnabled flag. This affects apps that register custom schemes with supportFetchAPI enabled but corsEnabled disabled and load untrusted content. The vulnerability allows cross-origin reading of responses, completing a previous fix (CVE-2026-70604). Fixed versions include 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5. Setting corsEnabled to true or avoiding loading untrusted content mitigates the issue.