CVE-2026-70604: Electron CORS Bypass Vulnerability

CVE-2026-70604 Overview

CVE-2026-70604 is a Cross-Origin Resource Sharing (CORS) bypass vulnerability in Electron, the framework for building cross-platform desktop applications using JavaScript, HTML, and CSS. A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. Remote pages loaded in a renderer can issue fetch() or XMLHttpRequest calls against the custom scheme cross-origin and read the full response body. Applications that serve sensitive data via such schemes and load remote or untrusted content are exposed to data exfiltration. The issue is fixed in Electron versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.

Critical Impact
Attackers controlling remote or untrusted web content loaded in an Electron renderer can read sensitive responses served by custom schemes, bypassing same-origin protections.

Affected Products

Electron versions prior to 39.8.10
Electron 40.x prior to 40.9.3, and 41.x prior to 41.4.0
Electron applications registering custom schemes with supportFetchAPI: true and corsEnabled unset

Discovery Timeline

2026-08-05 - CVE-2026-70604 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70604

Vulnerability Analysis

Electron allows applications to register custom URL schemes with a set of privileges through the protocol.registerSchemesAsPrivileged API. Two relevant flags govern network behavior: supportFetchAPI, which enables fetch() and XMLHttpRequest against the scheme, and corsEnabled, which subjects the scheme to CORS enforcement. Prior to the fixed releases, enabling supportFetchAPI without explicitly enabling corsEnabled produced a scheme that permitted cross-origin reads without CORS checks. A remote origin loaded in a renderer could therefore issue cross-origin requests against the custom scheme and read the full response body. This maps to CWE-942: Permissive Cross-domain Policy with Untrusted Domains.

Root Cause

The scheme registration logic treated the absence of corsEnabled as permissive rather than restrictive when supportFetchAPI was enabled. Instead of denying cross-origin reads by default, the browser process allowed the response to be returned to the requesting origin. This inversion of secure-by-default behavior is the underlying defect corrected in the patched versions.

Attack Vector

Exploitation requires an affected Electron application to load remote or untrusted content in a renderer, and to serve sensitive data through a custom scheme registered with supportFetchAPI: true but without corsEnabled: true. An attacker who controls a page loaded in the renderer, whether through a compromised third-party origin, an ad frame, or a phishing link opened in-app, can call fetch('customscheme://sensitive/resource') from JavaScript and read the response. The attack requires user interaction to load the malicious origin but no privileges on the target application. Refer to the Electron GitHub Security Advisory GHSA-v3j7-r9gq-3gjw for further technical detail.

Detection Methods for CVE-2026-70604

Indicators of Compromise

Unexpected fetch() or XMLHttpRequest calls from remote origins targeting application-registered custom schemes in renderer telemetry.
Outbound HTTP traffic from Electron applications following requests to attacker-controlled domains that correlate with cross-origin reads of internal data.
Renderer processes loading third-party or untrusted URLs in an application intended to host only first-party content.

Detection Strategies

Audit Electron application source for protocol.registerSchemesAsPrivileged calls and flag entries where supportFetchAPI is true and corsEnabled is omitted or false.
Inspect installed Electron application versions across the fleet and correlate against the fixed versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
Monitor Electron renderer network activity for cross-origin requests to non-HTTP schemes served by the application.

Monitoring Recommendations

Collect endpoint process and network telemetry from workstations running Electron-based applications and centralize it for query and correlation.
Alert on Electron renderer processes making external network connections shortly after receiving traffic on custom schemes.
Track child process creation and DNS resolution patterns for Electron apps that historically operate only against internal endpoints.

How to Mitigate CVE-2026-70604

Immediate Actions Required

Upgrade Electron to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 or later, matching the appropriate release branch.
Inventory all custom schemes registered by shipping applications and set corsEnabled: true wherever supportFetchAPI: true is used.
Restrict renderer content to first-party origins and disable navigation to untrusted URLs using will-navigate and setWindowOpenHandler handlers.

Patch Information

The Electron maintainers published fixes in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0. Application vendors must rebuild and redistribute their applications against a patched Electron release; end users cannot remediate by updating Electron independently. See the Electron GitHub Security Advisory GHSA-v3j7-r9gq-3gjw for release notes.

Workarounds

Explicitly register affected custom schemes with corsEnabled: true alongside supportFetchAPI: true to enforce CORS on cross-origin reads.
Serve sensitive data over origins that cannot be reached from untrusted renderer content, or move data access to the main process via IPC.
Enforce a strict Content Security Policy in renderer windows to prevent loading of attacker-controlled origins that could initiate cross-origin fetches.

bash

# Configuration example: register custom scheme with CORS enforcement
# In the Electron main process, before app 'ready'
protocol.registerSchemesAsPrivileged([
  {
    scheme: 'app',
    privileges: {
      standard: true,
      secure: true,
      supportFetchAPI: true,
      corsEnabled: true
    }
  }
])