{"id":"EUVD-2026-53440","enisaUuid":"8005f219-ce67-36ab-af38-d8d261b84804","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.","datePublished":"Aug 5, 2026, 3:59:24 PM","dateUpdated":"Aug 5, 2026, 6:41:32 PM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw\n","aliases":"CVE-2026-70604\nGHSA-v3j7-r9gq-3gjw\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"22eabea8-b295-3822-a5df-a149c9198927","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"40.0.0-alpha.1, \u003c 40.9.3"},{"id":"431fd098-df4b-362e-b5a1-28deaffd6864","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 39.8.10"},{"id":"9893c495-ef3a-3cbd-aac9-bb593e00dda2","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"41.0.0-alpha.1, \u003c 41.4.0"},{"id":"b0c2c90b-9932-3feb-86e1-3e99aaac6579","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.0.0"}],"enisaIdVendor":[{"id":"fb35aba3-6e2f-381a-8c8b-df2e44d40446","vendor":{"name":"electron"}}],"enisaIdVulnerability":[{"id":"1135bb57-b91e-384e-ad98-8ab3dbbaaf49","vulnerability":{"id":"GHSA-v3j7-r9gq-3gjw","description":"Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads","datePublished":"Aug 5, 2026, 3:59:45 PM","dateUpdated":"Aug 5, 2026, 3:59:45 PM","baseScore":0.0,"references":"https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw\nhttps://github.com/electron/electron\n","enisa_id":"EUVD-2026-53440\n","aliases":"GHSA-v3j7-r9gq-3gjw\nCVE-2026-70604\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"2904ef27-c617-302f-933c-ecb2165df978","vulnerability":{"id":"CVE-2026-70604","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.","datePublished":"Aug 5, 2026, 3:59:24 PM","dateUpdated":"Aug 5, 2026, 6:41:32 PM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw\n","enisa_id":"EUVD-2026-53440\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Nov 1, 2026, 7:13:53 AM","vulnerabilityProduct":[{"id":"38002a2b-8d16-30b9-a28b-a742cf3fb568","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"41.0.0-alpha.1, \u003c 41.4.0"},{"id":"5ed6f7f2-498c-3f9f-b4aa-f29b50ba9b76","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"40.0.0-alpha.1, \u003c 40.9.3"},{"id":"e0138f9d-1642-3236-93b3-671d4d78fb96","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 39.8.10"},{"id":"e777ebd8-4e2e-3518-9786-4bea8e907d3e","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.0.0"}],"vulnerabilityVendor":[{"id":"1b366be2-8bea-3a71-be39-48d61be1f3ec","vendor":{"name":"electron"}}]}}],"enisaIdAdvisory":[]}