{"uuid": "ade69e09-f5de-4510-ba07-0dc498ec4e2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70604", "type": "seen", "source": "https://gist.github.com/alon710/833f29b9d380bcf059ea629581974a6e", "content": "# CVE-2026-70604: CVE-2026-70604: Cross-Origin Resource Sharing (CORS) Bypass in Electron Custom Schemes\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70604\n\n## Summary\nElectron custom schemes registered with supportFetchAPI: true but without corsEnabled: true failed to apply CORS enforcement in versions prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0. This mapping discrepancy allowed malicious remote pages to issue cross-origin requests, read sensitive local response data, and bypass Same-Origin Policy (SOP) mechanisms.\n\n## TL;DR\nElectron custom protocols lacked CORS checks when supportFetchAPI was enabled without explicit corsEnabled configurations. This permitted remote pages to read sensitive local assets cross-origin.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-942: Permissive Cross-domain Policy with Untrusted Domains\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.4 (High Severity)\n- **Exploit Status**: PoC (Proof-of-Concept) Available\n- **KEV Status**: Not Listed\n- **Impact**: Confidentiality Bypass / Same-Origin Policy (SOP) Break\n\n## Affected Systems\n\n- Electron Framework\n- **Electron**: < 39.8.10 (Fixed in: `39.8.10`)\n- **Electron**: >= 40.0.0, < 40.9.3 (Fixed in: `40.9.3`)\n- **Electron**: >= 41.0.0, < 41.4.0 (Fixed in: `41.4.0`)\n- **Electron**: >= 42.0.0, < 42.0.0 (Fixed in: `42.0.0`)\n\n## Mitigation\n\n- Upgrade Electron to patched releases\n- Explicitly set corsEnabled: true on custom protocols\n- Disable supportFetchAPI if network requests to the protocol are unnecessary\n- Implement robust Content Security Policies (CSP) to restrict data exfiltration\n\n**Remediation Steps:**\n1. Identify all occurrences of protocol.registerSchemesAsPrivileged in the application's Main Process\n2. Verify if supportFetchAPI is set to true\n3. Ensure corsEnabled is explicitly declared as true for those protocols\n4. Update Electron dependency in package.json to at least 39.8.10, 40.9.3, 41.4.0, or 42.0.0\n5. Rebuild and redeploy the application\n\n## References\n\n- [GitHub Security Advisory GHSA-v3j7-r9gq-3gjw](https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw)\n- [CVE-2026-70604 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-70604)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70604) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T16:31:30.156301Z"}