CVE-2026-70604 in Electron
Summary
by MITRE • 08/05/2026
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability resides within the Electron framework's handling of custom URL schemes and their associated security policies. The flaw manifests when applications register custom schemes with the supportFetchAPI: true configuration parameter but fail to enable corsEnabled: true enforcement. This misconfiguration creates a critical security gap where remote origins can bypass Cross-Origin Resource Sharing restrictions through standard web APIs like fetch() or XMLHttpRequest operations against these custom schemes. The vulnerability represents a classic case of insufficient access control enforcement, allowing unauthorized cross-origin data retrieval from sensitive endpoints that should be protected by CORS policies.
The technical implementation of this flaw stems from Electron's scheme registration system where the framework's default security boundaries are weakened when specific configuration parameters are improperly set. When supportFetchAPI is enabled without corsEnabled, the underlying HTTP request handling mechanism fails to apply proper origin validation checks before allowing data retrieval operations across scheme boundaries. This creates an information disclosure scenario where malicious remote content can programmatically access sensitive resources served through custom schemes that contain confidential data or system-level information. The vulnerability directly impacts applications that serve critical data through custom schemes while simultaneously loading untrusted remote content within their renderer processes.
From an operational perspective, this vulnerability poses significant risks to Electron-based desktop applications that handle sensitive user data, authentication tokens, or system-level information. Applications affected include those that implement custom protocols for internal communication, local file access APIs, or privileged data services that rely on Electron's scheme handling mechanisms. The attack vector is particularly dangerous because it requires only the ability to inject remote content into a renderer process, which is common in many desktop applications that load external web resources or allow user-generated content. This vulnerability aligns with CWE-346, which addresses "Origin Validation Error", and represents an implementation of the broader class of security misconfigurations that can lead to unauthorized data access.
The exploitation of this vulnerability follows a predictable pattern where attackers craft malicious web content that loads from remote origins and attempts to fetch resources through the vulnerable custom scheme. The response body of these requests would normally be blocked by CORS enforcement, but due to the misconfiguration, complete responses are returned to the attacker. This enables information disclosure attacks against applications that serve sensitive data through custom schemes. Security practitioners should note this issue's relationship to ATT&CK technique T1071.004, which covers application layer protocol manipulation, and specifically targets the 'Web Protocols' sub-technique where attackers exploit protocol implementation flaws. The fix implemented in Electron versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0 addresses this by ensuring proper CORS enforcement is applied to all custom schemes that support fetch APIs, regardless of whether they were explicitly configured with corsEnabled.
Mitigation strategies for this vulnerability require immediate application updates to supported Electron versions along with careful review of custom scheme configurations within affected applications. Developers should audit their scheme registration code to ensure all custom schemes with supportFetchAPI: true also have corsEnabled: true enabled. Security teams should implement monitoring for unauthorized scheme usage and consider additional sandboxing measures for applications that handle sensitive data through custom protocols. The vulnerability demonstrates the critical importance of proper security configuration management and the potential consequences of incomplete security policy implementation in framework-level components that serve as foundational building blocks for desktop application security models.