Skip to content
Log inStart free trial

GHSA-v3j7-r9gq-3gjw CVE-2026-70604

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

High npm
Severity
7.4 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.35%
Chance of exploitation in the next 30 days. Higher than 29.18% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
Fix
42.0.0
Upgrade electron to this version or later

Description

Impact

A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked.

Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.

Workarounds

Set corsEnabled: true on schemes that must enforce CORS, and validate the request Origin in your protocol handler before returning sensitive data.

Fixed Versions

  • 42.0.0
  • 41.4.0
  • 40.9.3
  • 39.8.10

For more information

If you have any questions or comments about this advisory, email Electron at security@electronjs.org

Affected versions

npm

PackageVulnerableFixed in
electron
>= 42.0.0-alpha.1, < 42.0.0
42.0.0
electron
>= 41.0.0-alpha.1, < 41.4.0
41.4.0
electron
>= 40.0.0-alpha.1, < 40.9.3
40.9.3
electron
< 39.8.10
39.8.10

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

electron npm → 42.0.0

npm
npm install electron@42.0.0
yarn
yarn add electron@42.0.0
pnpm
pnpm add electron@42.0.0

Severity breakdown

CVSS 3.1 7.4

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Weakness

CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

How to prevent it
  • Architecture and Design, Operation: Define a restrictive Content Security Policy [REF-1486] or cross-domain policy file.
  • Architecture and Design, Operation: Avoid using wildcards in the CSP / cross-domain policy file. Any domain matching the wildcard expression will be implicitly trusted, and can perform two-way interaction with the target server.
  • Architecture and Design, Operation: For Flash, modify crossdomain.xml to use meta-policy options such as 'master-only' or 'none' to reduce the possibility of an attacker planting extraneous cross-domain policy files on a server.

References

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-qqvq-6xgj-jw8g
Electron affected by libvpx's heap buffer overflow in vp8 encoding
High Known exploited Also affects electron
GHSA-j7hp-h8jx-5ppr
libwebp: OOB write in BuildHuffmanTable
High Known exploited Also affects electron
GHSA-995f-9x5r-2rcj
Heap buffer overflow in GPU
Critical Known exploited Also affects electron
GHSA-jr5w-w6x2-84p9
Electron: Mitigation for compromised eMudhra intermediate certificates
High Also affects electron
GHSA-h3v5-h239-pg29
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Low Also affects electron
GHSA-3qxv-5xgr-q7w9
Electron: Frame subscription trusts GPU-supplied frame geometry
Low Also affects electron
GHSA-997q-gvvc-jwmx
Electron: openExternal permission requests can be attributed to the wrong origin
Medium Also affects electron
GHSA-fw47-9c62-h3vw
Electron: HID and USB permission checks can be attributed to the wrong origin
Medium Also affects electron
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor