Executive brief
A security flaw in the Electron framework could allow malicious websites to bypass security restrictions and read sensitive data from an application. This occurs when an application uses custom data protocols that are not properly configured to block unauthorized cross-site requests. If an application loads untrusted web content, an attacker could potentially steal user data or internal application information.
Technical details
A vulnerability exists in Electron's custom protocol handling where schemes registered with 'supportFetchAPI: true' but without 'corsEnabled: true' fail to enforce Cross-Origin Resource Sharing (CORS) policies. This allows a page loaded from a remote origin to use fetch() or XMLHttpRequest to access the custom scheme and read the full response body. The root cause is a permissive cross-domain security policy (CWE-942) in the protocol registration logic. Attackers can exploit this by enticing a user to visit a malicious site within an Electron renderer that loads untrusted content. Patches are available in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
Affected products
- Electron Electron < 39.8.10, >= 40.0.0-alpha.1, < 40.9.3, >= 41.0.0-alpha.1, < 41.4.0, >= 42.0.0-alpha.1, < 42.0.0
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory