CyberRota Analysis
AI-GeneratedApplications using Electron versions prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0 are vulnerable due to improper CORS enforcement on custom schemes, allowing remote origins to perform cross-origin fetches and read sensitive data. This vulnerability poses a significant risk to apps that serve sensitive information and load untrusted content, potentially leading to data exposure. Developers and organizations utilizing affected Electron versions should prioritize updating to the fixed versions to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.