CVE-2026-70604: Electron cross-origin read in custom protocol handlers

CVE-2026-70604 · Severity: high · CVSS 7.4 · Published 2026-08-05

A security flaw in the Electron framework could allow malicious websites to bypass security restrictions and read sensitive data from an application. This occurs when an application uses custom data protocols that are not properly configured to block unauthorized cross-site requests. If an application loads untrusted web content, an attacker could potentially steal user data or internal application information.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2026-70604 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-70604 being exploited in the wild.
How severe is CVE-2026-70604?
High severity, with a CVSS score of 7.4, published 5 August 2026.
Which products and versions are affected?
electron (npm) SEMVER:introduced=42.0.0-alpha.1,fixed=42.0.0.
Is there a fix for CVE-2026-70604?
Yes. electron (npm): upgrade to 42.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70604 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-70604?
Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electron (npm): upgrade to 42.0.0 or later
    npm install electron@42.0.0

Technical details

A vulnerability exists in Electron's custom protocol handling where schemes registered with 'supportFetchAPI: true' but without 'corsEnabled: true' fail to enforce Cross-Origin Resource Sharing (CORS) policies. This allows a page loaded from a remote origin to use fetch() or XMLHttpRequest to access the custom scheme and read the full response body. The root cause is a permissive cross-domain security policy (CWE-942) in the protocol registration logic. Attackers can exploit this by enticing a user to visit a malicious site within an Electron renderer that loads untrusted content. Patches are available in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.

Affected products

  • Electron Electron < 39.8.10, >= 40.0.0-alpha.1, < 40.9.3, >= 41.0.0-alpha.1, < 41.4.0, >= 42.0.0-alpha.1, < 42.0.0

Identifiers

  • CVE-2026-70604
  • GHSA-v3j7-r9gq-3gjw

Timeline

  • 2026-07-27: disclosed
  • 2026-08-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.