High 7.4Published Sep 29, 2026

CVE-2026-102675Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Updated under an hour ago (Oct 28, 2026, 9:50 AM ET)

Does this affect you?

It affects electron and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.21%, higher than 11% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for electron

Exploited in the last 30 days

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness (CWE): CWE-346
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.21% (percentile 11)
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Sep 29, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

electron electron electron:electron (from the name)	before 41.10.6; from 42.0.0-alpha.1, < 42.9.2; from 43.0.0-alpha.1, < 43.4.1; from 44.0.0-alpha.1, < 44.0.0-beta.5	CNA record
electronjs electron electronjs:electron	before 41.10.6; from 42.0.0 before 42.9.2; from 43.0.0 before 43.4.1; 44.0.0; 44.0.0; 44.0.0; 44.0.0; 44.0.0; and 8 more ranges	NVD

References

References

https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj	x-refsource-confirm, vendor-advisory, mitigation
https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d	x-refsource-misc, patch
https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d	x-refsource-misc, patch
https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397	x-refsource-misc, patch
https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2	x-refsource-misc, patch
https://github.com/electron/electron/releases/tag/v41.10.6	x-refsource-misc, release-notes
https://github.com/electron/electron/releases/tag/v42.9.2	x-refsource-misc, release-notes
https://github.com/electron/electron/releases/tag/v43.4.1	x-refsource-misc, release-notes
https://github.com/electron/electron/releases/tag/v44.0.0-beta.5	x-refsource-misc, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.