CORS Bypass Vulnerability in Electron Framework Affecting Multiple Versions
CVE-2026-70604

7.4HIGH

Key Information:

Vendor

Electron

Status
Electron
Vendor
CVE Published:
5 August 2026

What is CVE-2026-70604?

A vulnerability in the Electron framework allows remote pages loaded from untrusted origins to bypass Cross-Origin Resource Sharing (CORS) protections. Specifically, a custom scheme with 'supportFetchAPI' enabled but 'corsEnabled' disabled can result in unauthorized access to sensitive data. This may allow a remote origin to perform XMLHttpRequest or fetch requests on behalf of the user, leading to potential data leaks. Versions prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0 are affected. Users are advised to upgrade to the latest versions for enhanced security.

Affected Version(s)

electron < 39.8.10 < 39.8.10

electron >= 40.0.0-alpha.1, < 40.9.3 < 40.0.0-alpha.1, 40.9.3

electron >= 41.0.0-alpha.1, < 41.4.0 < 41.0.0-alpha.1, 41.4.0

References

https://github.com/electron/electron/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.