What is the CVSS score of EUVD-2026-53440?

EUVD-2026-53440 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Electron are affected by EUVD-2026-53440?

A cross-origin read bypass vulnerability in Electron's custom protocol handler (CVE-2026-70604) allows attackers to exfiltrate sensitive application data; no public exploit identified at time of…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-53440?

Yes, a public proof-of-concept exploit is available for EUVD-2026-53440. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-53440?

Within 24 hours, inventory all Electron applications currently deployed and identify those using custom scheme handlers with supportFetchAPI enabled, filtering for versions prior to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 depending on release branch. Within 7 days, coordinate with development teams to schedule maintenance windows for upgrading Electron to the appropriate patched version for each application's branch (39.8.10 for 39.x, 40.9.3 for 40.x, 41.4.0 for 41.x, or 42.0.0 for 42.x). Within 30 days, deploy the vendor-released patches across all identified applications and verify that custom protocol handlers are configured with corsEnabled: true to enforce CORS restrictions.

Electron EUVD-2026-53440

| CVE-2026-70604 HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-08-05 GitHub_M

GHSA-v3j7-r9gq-3gjw

Information Disclosure Cors Misconfiguration Electron

7.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

vuln.today AI

7.4 HIGH

Network-delivered, victim must load malicious page (UI:R); scope change reflects cross-origin boundary breach into custom scheme data; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 05, 2026 - 17:02 EUVD

Source Code Evidence Fetched

Aug 05, 2026 - 16:36 vuln.today

Analysis Generated

Aug 05, 2026 - 16:36 vuln.today

CVE Published

Aug 05, 2026 - 15:59 cve.org

HIGH 7.4

DescriptionCVE.org

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked. Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. This issue is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0.

AnalysisAI

Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fetch() and XMLHttpRequest. Electron apps on any branch prior to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 that register a custom scheme with supportFetchAPI: true but omit corsEnabled: true fail to enforce CORS, allowing a malicious remote page loaded in the renderer to read the full response body of privileged custom-scheme requests. No public exploit code is identified at time of analysis and the vulnerability is not in CISA KEV, but the confidentiality impact is rated high by the vendor given the potential to exfiltrate internal application data.

Technical ContextAI

Electron's protocol module allows applications to define custom URL schemes (e.g., myapp://) that intercept network requests in the Chromium renderer. When a scheme is registered with supportFetchAPI: true, Electron signals to Chromium that the scheme participates in the Fetch API. CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) is the root cause: Electron failed to apply CORS enforcement to such schemes unless the developer also explicitly set corsEnabled: true, meaning Chromium's cross-origin read blocking was bypassed for these scheme responses. A renderer loading content from a remote HTTP origin could therefore issue a fetch() or XHR to the custom scheme across the origin boundary and receive the full, unblocked response - behaviour that CORS is specifically designed to prevent. The affected CPE is cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*, spanning all major branches.

RemediationAI

Upgrade Electron to one of the patched releases - 39.8.10, 40.9.3, 41.4.0, or 42.0.0 - which enforce CORS correctly for custom schemes regardless of the corsEnabled flag state, as documented in GHSA-v3j7-r9gq-3gjw (https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw). For teams unable to upgrade immediately, the vendor-confirmed workaround is to set corsEnabled: true on every custom scheme that uses supportFetchAPI: true; additionally, validate the Origin header inside the protocol handler before returning any sensitive data, which provides defence-in-depth even if CORS headers are misconfigured. Note that enabling corsEnabled: true may require updating legitimate callers to comply with CORS preflight requirements (adding appropriate Access-Control-Allow-Origin response headers), and that Origin validation in the handler must be maintained as an ongoing control if upgrading is delayed.