All vulnerabilities
CVE-2026-102675GHSA-j84w-jfhq-vhvj

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

electron electronnpmRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
7.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in41.10.6Also 42.9.2, 43.4.1 and 1 moreGitHub
Published29 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

  • 41.10.6electron, npmGitHubnpm install electron@41.10.6
  • 42.9.2electron, npmGitHubnpm install electron@42.9.2
  • 43.4.1electron, npmGitHubnpm install electron@43.4.1
  • 44.0.0-beta.5electron, npmGitHubnpm install electron@44.0.0-beta.5

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI: true but without corsEnabled: true could be read cross-origin by web content. This completes the fix for CVE-2026-70604.

Apps are only affected if they register such a scheme, serve it through one of those handlers, and load untrusted content. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.

Workarounds

Set corsEnabled: true on the scheme, or do not load untrusted content in windows that can reach it.

Fixed Versions

  • 44.0.0-beta.5
  • 43.4.1
  • 42.9.2
  • 41.10.6

For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

Text from GitHub Advisory Database

Affected versions 12

  • electron, npm< 41.10.6GitHub
  • electron, npm>= 42.0.0-alpha.1, < 42.9.2GitHub
  • electron, npm>= 43.0.0-alpha.1, < 43.4.1GitHub
  • electron, npm>= 44.0.0-alpha.1, < 44.0.0-beta.5GitHub
  • electronaffected: < 41.10.6CVE List
  • electronaffected: >= 42.0.0-alpha.1, < 42.9.2CVE List
  • electronaffected: >= 43.0.0-alpha.1, < 43.4.1CVE List
  • electronaffected: >= 44.0.0-alpha.1, < 44.0.0-beta.5CVE List
  • electron, npmfrom first release, fixed in 41.10.6OSV
  • electron, npmfrom 42.0.0-alpha.1, fixed in 42.9.2OSV
  • electron, npmfrom 43.0.0-alpha.1, fixed in 43.4.1OSV
  • electron, npmfrom 44.0.0-alpha.1, fixed in 44.0.0-beta.5OSV

References 10