PkgSeer

Vulnerability GHSA-j84w-jfhq-vhvj

High Risk

22 days ago

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4

Summary

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Details

Impact

Responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI: true but without corsEnabled: true could be read cross-origin by web content. This completes the fix for CVE-2026-70604.

Apps are only affected if they register such a scheme, serve it through one of those handlers, and load untrusted content. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.

Workarounds

Set corsEnabled: true on the scheme, or do not load untrusted content in windows that can reach it.

Fixed Versions

44.0.0-beta.5
43.4.1
42.9.2
41.10.6

For more information

If you have any questions or comments about this advisory, email us at [email protected]

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Electron: HID and USB permission checks can be attributed to the wrong origin

0.1.0 - 42.11.2 and 43.0.0-alpha.1 - 43.6.0 and 44.0.0-alpha.1 - 44.2.0 and 45.0.0-alpha.1 - 45.0.0-alpha.4 GHSA-fw47-9c62-h3vw

Electron: Local race condition in Squirrel.Mac update installation on macOS

0.1.0 - 39.8.9 and 40.0.0-alpha.2 - 41.10.4 and 42.0.0-alpha.1 - 42.0.0-beta.1 GHSA-vv43-5jgx-7qv8

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

0.1.0 - 41.10.3 and 42.0.0-alpha.1 - 42.5.1 and 43.0.0-alpha.1 - 43.0.0-beta.8 GHSA-hq2x-r82h-9wj4

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-gr2m-v5gq-v685

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

0.1.0 - 41.10.5 and 42.0.0-alpha.1 - 42.9.1 and 43.0.0-alpha.1 - 43.4.0 and 44.0.0-alpha.1 - 44.0.0-beta.4 GHSA-9qh4-3jw8-366w

View all vulnerabilities for these packages

Impacted packages

electron

Timeline

Published

22 days ago

Fixed (43.4.1)

2 months ago

Fixed (41.10.6)

Unknown

Fixed (42.9.2)

Unknown

Fixed (44.0.0-beta.5)

Unknown

Last Modified

22 days ago