{"id":"EUVD-2026-89093","enisaUuid":"6cd7f224-e24f-36ec-89f8-78a0478eddd0","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.","datePublished":"Sep 29, 2026, 4:54:29 PM","dateUpdated":"Sep 29, 2026, 5:26:51 PM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj\nhttps://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d\nhttps://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d\nhttps://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397\nhttps://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2\nhttps://github.com/electron/electron/releases/tag/v41.10.6\nhttps://github.com/electron/electron/releases/tag/v42.9.2\nhttps://github.com/electron/electron/releases/tag/v43.4.1\nhttps://github.com/electron/electron/releases/tag/v44.0.0-beta.5\n","aliases":"CVE-2026-102675\nGHSA-j84w-jfhq-vhvj\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"2537816b-8c08-3f3b-8939-9ca57cc4dbff","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"44.0.0-alpha.1, \u003c 44.0.0-beta.5"},{"id":"5ffd838d-e361-33d5-9047-68ea6c01f658","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.9.2"},{"id":"66805a08-3293-3d60-b94a-c5b52aff13e1","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"43.0.0-alpha.1, \u003c 43.4.1"},{"id":"854a12bf-2717-31fa-8dde-5d800e6af8b3","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 41.10.6"}],"enisaIdVendor":[{"id":"8749b275-67d6-3299-9495-65d83dfed780","vendor":{"name":"electron"}}],"enisaIdVulnerability":[{"id":"a3f11c33-9856-34be-9ff0-acceb5057c02","vulnerability":{"id":"CVE-2026-102675","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.","datePublished":"Sep 29, 2026, 4:54:29 PM","dateUpdated":"Sep 29, 2026, 5:26:51 PM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","references":"https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj\nhttps://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d\nhttps://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d\nhttps://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397\nhttps://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2\nhttps://github.com/electron/electron/releases/tag/v41.10.6\nhttps://github.com/electron/electron/releases/tag/v42.9.2\nhttps://github.com/electron/electron/releases/tag/v43.4.1\nhttps://github.com/electron/electron/releases/tag/v44.0.0-beta.5\n","enisa_id":"EUVD-2026-89093\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Oct 27, 2026, 7:15:40 AM","vulnerabilityProduct":[{"id":"208caa0e-3ff6-3afe-ae97-1b79cfc06677","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"42.0.0-alpha.1, \u003c 42.9.2"},{"id":"3ace428d-5384-39ea-9e16-20b524d3cffb","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"44.0.0-alpha.1, \u003c 44.0.0-beta.5"},{"id":"442af860-0162-3b37-ab8d-397cebfac571","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"43.0.0-alpha.1, \u003c 43.4.1"},{"id":"ace621e5-ecac-3ccb-81e9-4e57157e239f","product":{"name":"electron","vendor":{"name":"electron"}},"product_version":"\u003c 41.10.6"}],"vulnerabilityVendor":[{"id":"deef132f-95b9-3a50-ab15-0958b66cd0f5","vendor":{"name":"electron"}}]}},{"id":"e662c795-830a-34cc-9b8a-7f60955778d4","vulnerability":{"id":"GHSA-j84w-jfhq-vhvj","description":"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled","datePublished":"Sep 29, 2026, 6:04:24 PM","dateUpdated":"Sep 29, 2026, 6:04:25 PM","baseScore":0.0,"references":"https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj\nhttps://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d\nhttps://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d\nhttps://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397\nhttps://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2\nhttps://github.com/electron/electron\nhttps://github.com/electron/electron/releases/tag/v41.10.6\nhttps://github.com/electron/electron/releases/tag/v42.9.2\nhttps://github.com/electron/electron/releases/tag/v43.4.1\nhttps://github.com/electron/electron/releases/tag/v44.0.0-beta.5\n","enisa_id":"EUVD-2026-89093\n","aliases":"CVE-2026-102675\nGHSA-j84w-jfhq-vhvj\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}