CyberRota Analysis
AI-GeneratedApplications using Electron versions prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 are vulnerable to cross-origin script readability due to improper handling of custom schemes with supportFetchAPI enabled and corsEnabled disabled. This vulnerability can allow untrusted content to access sensitive data across origins, posing a significant risk to applications that load such content in the same session. Developers and organizations utilizing Electron for cross-platform desktop applications should prioritize updating to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.