CVE-2026-102675: Electron Package Cross-Origin Read Vulnerability
Summary
CVE-2026-102675: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled. Affects electron across 4 version ranges.
< 41.10.6
>= 42.0.0-alpha.1, < 42.9.2
>= 43.0.0-alpha.1, < 43.4.1
>= 44.0.0-alpha.1, < 44.0.0-beta.5
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Electron is a popular framework that enables developers to build cross-platform desktop applications using web technologies like JavaScript, HTML, and CSS. It combines the Chromium rendering engine and the Node.js runtime, allowing developers to create rich desktop applications with web capabilities. However, Electron's flexibility can introduce security vulnerabilities, particularly when handling custom protocols and untrusted content.
Vulnerability Detail
The vulnerability arises from the improper handling of responses served through 'protocol.registerFileProtocol' or 'protocol.registerHttpProtocol' for custom schemes that are registered with 'supportFetchAPI: true' but without 'corsEnabled: true'. This oversight allows web content to read responses cross-origin, potentially exposing sensitive data. The issue is particularly concerning for applications that load untrusted content, as it can lead to unauthorized access to resources.
How To Fix
Latest published version: 45.0.0 as of 22 Oct 2026
npm install electron@45.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 41.10.641.10.6npm install electron@41.10.6 -
>= 42.0.0-alpha.1, < 42.9.242.9.2npm install electron@42.9.2 -
>= 43.0.0-alpha.1, < 43.4.143.4.1npm install electron@43.4.1 -
>= 44.0.0-alpha.1, < 44.0.0-beta.544.0.0-beta.5npm install electron@44.0.0-beta.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can set 'corsEnabled: true' on the custom scheme to mitigate the risk. Additionally, avoid loading untrusted content in windows that can access the vulnerable protocol handlers. Here is an example of how to set 'corsEnabled':
const { protocol } = require('electron');
protocol.registerHttpProtocol('custom-scheme', (request, callback) => {
callback({
url: 'http://example.com',
corsEnabled: true
});
});
Conclusion
CVE-2026-102675 presents a significant security risk for Electron applications that utilize custom protocol handlers without proper CORS settings. Developers are urged to update to the latest patched versions of Electron and implement recommended workarounds to safeguard their applications against potential exploits.
See every vulnerability recorded for electron →
FAQ
CVE-2026-102675 is a vulnerability in the Electron framework that allows cross-origin reads of resources served through custom protocol handlers without proper CORS settings.
If your application registers a custom protocol without enabling CORS and loads untrusted content, it may expose sensitive data to malicious actors.
Versions prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for electron.
