CVE-2026-102675: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
Responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI: true but without corsEnabled: true could be read cross-origin by web content. This completes the fix for CVE-2026-70604.
Apps are only affected if they register such a scheme, serve it through one of those handlers, and load untrusted content. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.
References
- github.com/advisories/GHSA-j84w-jfhq-vhvj
- github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d
- github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d
- github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397
- github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2
- github.com/electron/electron/releases/tag/v41.10.6
- github.com/electron/electron/releases/tag/v42.9.2
- github.com/electron/electron/releases/tag/v43.4.1
- github.com/electron/electron/releases/tag/v44.0.0-beta.5
- github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj
- nvd.nist.gov/vuln/detail/CVE-2026-102675
Code Behaviors & Features
Detect and mitigate CVE-2026-102675 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →