CVE-2026-102675

HIGH

MEDIUM Priority: 0.02 BB Relevance: 65/100

Published: 2026-09-29 Modified: 2026-10-27 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: Required

S: Changed

C: High

I: None

A: None

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

Weakness Classification (1)

CWE-346

Affected Software (14)

Vendor	Product	Version
electronjs	electron	< 41.10.6
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0
electronjs	electron	44.0.0