EUVD-2026-53440
GHSA-v3j7-r9gq-3gjw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Network-delivered, victim must load malicious page (UI:R); scope change reflects cross-origin boundary breach into custom scheme data; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.
AnalysisAI
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fetch() and XMLHttpRequest. Electron apps on any branch prior to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 that register a custom scheme with supportFetchAPI: true but omit corsEnabled: true fail to enforce CORS, allowing a malicious remote page loaded in the renderer to read the full response body of privileged custom-scheme requests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following application-level conditions to hold simultaneously: the Electron app must register a custom URL scheme with supportFetchAPI: true AND without corsEnabled: true; that custom scheme must serve data considered sensitive or private (e.g., user credentials, internal configuration, tokens); and the app must load remote or untrusted third-party content in a renderer process (e.g., via BrowserWindow navigating to an external URL, or via a webview tag). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.4 score with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N reflects a network-reachable, low-complexity confidentiality breach that crosses a security scope boundary, consistent with the CORS bypass mechanism. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page and entices a victim to open it inside an Electron application's renderer - for example, via an embedded webview or a BrowserWindow pointing at an attacker-controlled URL. The page issues a fetch() call to a privileged custom scheme (e.g., myapp://api/userdata) that the Electron app exposes to serve internal configuration or authentication tokens. … |
| Remediation | Upgrade Electron to one of the patched releases - 39.8.10, 40.9.3, 41.4.0, or 42.0.0 - which enforce CORS correctly for custom schemes regardless of the corsEnabled flag state, as documented in GHSA-v3j7-r9gq-3gjw (https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Electron applications currently deployed and identify those using custom scheme handlers with supportFetchAPI enabled, filtering for versions prior to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 depending on release branch. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditional
Cross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today