{"id":"CVE-2026-70604","sourceIdentifier":"security-advisories@github.com","published":"2026-08-05T16:17:04.617","lastModified":"2026-10-08T13:53:51.593","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"electron","product":"electron","versions":[{"version":"< 39.8.10","status":"affected"},{"version":">= 40.0.0-alpha.1, < 40.9.3","status":"affected"},{"version":">= 41.0.0-alpha.1, < 41.4.0","status":"affected"},{"version":">= 42.0.0-alpha.1, < 42.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-05T18:13:52.321211Z","id":"CVE-2026-70604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-942"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*","versionEndExcluding":"39.8.10","matchCriteriaId":"6038A7D4-16F2-4940-AA5B-E5235C86FEEA"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*","versionStartIncluding":"40.0.0","versionEndExcluding":"40.9.3","matchCriteriaId":"6F474638-6FCC-4E25-A641-6E3B57BEFD55"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*","versionStartIncluding":"41.0.0","versionEndExcluding":"41.4.0","matchCriteriaId":"2CD7048D-1D1D-41BF-AC8C-A17CF85ADFBC"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:alpha1:*:*:*:node.js:*:*","matchCriteriaId":"498062D8-5C83-4FC2-A04B-94F3228B2BED"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:alpha2:*:*:*:node.js:*:*","matchCriteriaId":"A272F9F4-AB62-407C-B1A8-18586A474C19"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:alpha3:*:*:*:node.js:*:*","matchCriteriaId":"BF49E260-9653-4D26-8B6C-C6FAFE697F5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:alpha4:*:*:*:node.js:*:*","matchCriteriaId":"2F3B609A-0CA5-4E8C-865E-CF79B6B0CCCC"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:alpha5:*:*:*:node.js:*:*","matchCriteriaId":"308A710A-7965-40A0-87E4-2B66A8CEF87A"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:alpha6:*:*:*:node.js:*:*","matchCriteriaId":"6CFEB6F4-A38A-43BC-92B1-2E1DC8BBD1D7"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:beta1:*:*:*:node.js:*:*","matchCriteriaId":"7B9FD9F4-48E0-4EA2-957D-57ADA2A3D42A"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:beta2:*:*:*:node.js:*:*","matchCriteriaId":"62E12D3F-154E-44AB-919F-0E34E970C2CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:beta3:*:*:*:node.js:*:*","matchCriteriaId":"1860288A-C1FE-47A4-9C05-FD8EDDCE7093"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:beta4:*:*:*:node.js:*:*","matchCriteriaId":"83C96449-AF09-442A-BE4C-39A298557337"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:beta5:*:*:*:node.js:*:*","matchCriteriaId":"5AED130C-260D-47AA-8A07-11A5AC310E36"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:beta6:*:*:*:node.js:*:*","matchCriteriaId":"5E6EB469-107E-4A62-9C89-1BD90B6C8263"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:beta7:*:*:*:node.js:*:*","matchCriteriaId":"01C12A55-5CE8-48E7-8F91-52A574D4C39A"},{"vulnerable":true,"criteria":"cpe:2.3:a:electronjs:electron:42.0.0:beta8:*:*:*:node.js:*:*","matchCriteriaId":"1686FF0B-11E1-464D-99D7-32C46D922D10"}]}]}],"references":[{"url":"https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}