CVE-2026-70604
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
How to fix
- electronjs electron39.8.10, 40.9.3, 41.4.0 or later
- electron42.0.0, 41.4.0, 40.9.3, 39.8.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| electronjs electron | v < 39.8.10, 40.0.0 ≤ v < 40.9.3, 41.0.0 ≤ v < 41.4.0, 42.0.0 | 39.8.10, 40.9.3, 41.4.0 |
| electronnpm | 42.0.0-alpha.1 ≤ v < 42.0.0, 41.0.0-alpha.1 ≤ v < 41.4.0, 40.0.0-alpha.1 ≤ v < 40.9.3, v < 39.8.10 | 42.0.0, 41.4.0, 40.9.3, 39.8.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.