# CVE-2026-102675: Electron protocol handlers cross-origin read bypass

Source: https://junglewise.ai/threats/cve-2026-102675-electron-is-a-framework-for-writing-cross-platform-desktop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102675 · Severity: high · CVSS 7.4 · Published 2026-09-29

Electron's file and HTTP protocol handlers can be exploited to read sensitive data cross-origin when a custom scheme is registered with fetch API support but without CORS protection. An attacker who tricks a user into loading malicious web content in an Electron app can steal data from responses served through unprotected custom protocols, potentially exposing application secrets, configuration, or user information.

Technologies: [Electron](https://junglewise.ai/threats/technologies/electron-electron), [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [Electron](https://junglewise.ai/threats/vendors/electron), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-102675 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102675 being exploited in the wild.

**How severe is CVE-2026-102675?** High severity, with a CVSS score of 7.4, published 29 September 2026.

**Which products and versions are affected?** Electron < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5, Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5; electron (npm) SEMVER:introduced=0,fixed=41.10.6.

**Is there a fix for CVE-2026-102675?** Yes. electron (npm): upgrade to 41.10.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102675 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102675?** Check whether you run Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 41.10.6 or later

  ```sh
  npm install electron@41.10.6
  ```


## Technical details

An origin validation error in Electron's protocol.registerFileProtocol and protocol.registerHttpProtocol allows cross-origin reads when supportFetchAPI is enabled without corsEnabled set to true. An attacker can perform cross-origin fetch requests from untrusted web content to access responses served through these handlers, bypassing same-origin policy. The vulnerability requires user interaction (loading untrusted content) and affects only apps that register such schemes without proper CORS configuration.

## Affected products

- Electron Electron < 41.10.6; >= 42.0.0-alpha.1, < 42.9.2; >= 43.0.0-alpha.1, < 43.4.1; >= 44.0.0-alpha.1, < 44.0.0-beta.5

## Identifiers

- CVE-2026-102675
- GHSA-j84w-jfhq-vhvj

## Timeline

- 2026-08-29: disclosed
- 2026-09-29: patched: Fixed in versions 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5

## References

- [https://api.github.com/users/manus-use](https://api.github.com/users/manus-use)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)