Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-70604 Cross-Origin Request Vulnerability in Electron Custom Schemes Before 42.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-70604
Post summary
The text references CVE‑2026‑70604 and gives a brief vulnerability description, but provides no additional details, PoC, exploit code, or mitigation information.
🚨High - Electron Custom Scheme CORS Bypass via supportFetchAPI (CVE-2026-70604) Electron custom schemes registered with supportFetchAPI: true but without corsEnabled bypass CORS enforcement. Remote/untrusted renderer pages can use fetch()/XMLHttpRequest to read full response bodies from the scheme cross-origin, leaking sensitive app data. Schemes with corsEnabled are not affected. 👉Affected: electron < 39.8.10, 40.x < 40.9.3, 41.x < 41.4.0, 42.x < 42.0.0 | Upgrade to 39.8.10/40.9.3/41.4.0/42.0.0
Post summary
The post discloses a high‑severity CORS bypass in Electron, offers technical details, and recommends patching to fixed versions.
15 of 15 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | electronjs | electron | - | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |
| App | electronjs | electron | 42.0.0 | node.js | - |