CVE-2026-102675

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102675", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T16:10:04.075Z", "datePublished": "2026-09-29T16:54:29.218Z", "dateUpdated": "2026-09-29T17:26:51.547Z"}, "containers": {"cna": {"title": "Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj"}, {"name": "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d"}, {"name": "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d"}, {"name": "https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397"}, {"name": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2"}, {"name": "https://github.com/electron/electron/releases/tag/v41.10.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v41.10.6"}, {"name": "https://github.com/electron/electron/releases/tag/v42.9.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v42.9.2"}, {"name": "https://github.com/electron/electron/releases/tag/v43.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v43.4.1"}, {"name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"}], "affected": [{"vendor": "electron", "product": "electron", "versions": [{"version": "< 41.10.6", "status": "affected"}, {"version": ">= 42.0.0-alpha.1, < 42.9.2", "status": "affected"}, {"version": ">= 43.0.0-alpha.1, < 43.4.1", "status": "affected"}, {"version": ">= 44.0.0-alpha.1, < 44.0.0-beta.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T16:54:29.218Z"}, "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."}], "source": {"advisory": "GHSA-j84w-jfhq-vhvj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T17:25:31.410322Z", "id": "CVE-2026-102675", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T17:26:51.547Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-102675", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T17:25:31.410322Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T17:26:39.230Z"}}], "cna": {"title": "Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled", "source": {"advisory": "GHSA-j84w-jfhq-vhvj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "electron", "product": "electron", "versions": [{"status": "affected", "version": "< 41.10.6"}, {"status": "affected", "version": ">= 42.0.0-alpha.1, < 42.9.2"}, {"status": "affected", "version": ">= 43.0.0-alpha.1, < 43.4.1"}, {"status": "affected", "version": ">= 44.0.0-alpha.1, < 44.0.0-beta.5"}]}], "references": [{"url": "https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj", "name": "https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d", "name": "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d", "name": "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397", "name": "https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2", "name": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v41.10.6", "name": "https://github.com/electron/electron/releases/tag/v41.10.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v42.9.2", "name": "https://github.com/electron/electron/releases/tag/v42.9.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v43.4.1", "name": "https://github.com/electron/electron/releases/tag/v43.4.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5", "name": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-29T16:54:29.218Z"}}}, "cveMetadata": {"cveId": "CVE-2026-102675", "state": "PUBLISHED", "dateUpdated": "2026-09-29T17:26:51.547Z", "dateReserved": "2026-09-29T16:10:04.075Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-29T16:54:29.218Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "electron", "vendor": "electron", "versions": [{"status": "affected", "version": "< 41.10.6"}, {"status": "affected", "version": ">= 42.0.0-alpha.1, < 42.9.2"}, {"status": "affected", "version": ">= 43.0.0-alpha.1, < 43.4.1"}, {"status": "affected", "version": ">= 44.0.0-alpha.1, < 44.0.0-beta.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "B4FB09FD-C08F-43AC-8CEC-1A0677E7AF43", "versionEndExcluding": "41.10.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F06ED6A9-4328-4DA8-992F-EEFA235B40CD", "versionEndExcluding": "42.9.2", "versionStartIncluding": "42.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "57780223-7E96-4EE7-88EA-AC7A44AFE435", "versionEndExcluding": "43.4.1", "versionStartIncluding": "43.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "94D88EA0-06B8-4682-B01F-D3E1D7F6F806", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha2:*:*:*:node.js:*:*", "matchCriteriaId": "796732E1-53E5-4D7F-AA0C-9CBDD29F7210", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha3:*:*:*:node.js:*:*", "matchCriteriaId": "522046B0-9E6A-481A-A8B2-69AD79D61259", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha4:*:*:*:node.js:*:*", "matchCriteriaId": "7073A25C-D7C8-42C6-9A19-AF45BE0CDF9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha5:*:*:*:node.js:*:*", "matchCriteriaId": "FD3928C5-4200-4CA6-864C-2537CFCF1039", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha6:*:*:*:node.js:*:*", "matchCriteriaId": "F2E8594F-E690-47D9-BFB9-22E127F4EEC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha7:*:*:*:node.js:*:*", "matchCriteriaId": "3106D6D5-37B3-4422-AB92-95E81B8B18F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha8:*:*:*:node.js:*:*", "matchCriteriaId": "990B95FF-4B70-4E2A-9ADE-96DB4FD83F58", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:alpha9:*:*:*:node.js:*:*", "matchCriteriaId": "550B3853-4CD1-491C-9C66-E3DBDEF5415F", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:beta1:*:*:*:node.js:*:*", "matchCriteriaId": "F3DCC540-D8FC-4602-8150-4F5FA7E6AE8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:beta2:*:*:*:node.js:*:*", "matchCriteriaId": "A6DBFDE8-90FE-47A1-9311-CDADB8598818", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:beta3:*:*:*:node.js:*:*", "matchCriteriaId": "42385506-40E0-4520-86B8-7EA679DD68F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:44.0.0:beta4:*:*:*:node.js:*:*", "matchCriteriaId": "2061B84C-AC6C-4F81-B14B-EA747246A048", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5."}], "id": "CVE-2026-102675", "lastModified": "2026-10-27T18:41:28.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102675", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T17:25:31.410322Z", "version": "2.0.3"}}]}, "published": "2026-09-29T17:17:07.813", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v41.10.6"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v42.9.2"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v43.4.1"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/electron/electron/releases/tag/v44.0.0-beta.5"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory", "Mitigation"], "url": "https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers", "id": "2543317", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543317"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604. Applications are affected only when they expose such a scheme and load untrusted content in the same session. Schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design. This issue is fixed in versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.", "A flaw was found in Electron. When an application registers a custom scheme using file or HTTP protocol handlers with Fetch API support enabled but Cross-Origin Resource Sharing (CORS) disabled, responses remain script-readable across origins. If untrusted content is loaded within the same session, an attacker can exploit this vulnerability to bypass origin restrictions and read sensitive application data, resulting in information disclosure."], "mitigation": {"lang": "en:us", "value": "Ensure custom schemes registered with supportFetchAPI explicitly enable corsEnabled, or avoid loading untrusted web content within sessions where custom protocol schemes with disabled CORS controls are registered."}, "name": "CVE-2026-102675", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Affected", "package_name": "rh-podman-desktop", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "podman-desktop", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rh-podman-desktop", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-09-29T16:54:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-102675\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102675\nhttps://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d\nhttps://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d\nhttps://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397\nhttps://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2\nhttps://github.com/electron/electron/releases/tag/v41.10.6\nhttps://github.com/electron/electron/releases/tag/v42.9.2\nhttps://github.com/electron/electron/releases/tag/v43.4.1\nhttps://github.com/electron/electron/releases/tag/v44.0.0-beta.5\nhttps://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj"], "statement": "A flaw was found in Electron where responses served via protocol.registerFileProtocol or protocol.registerHttpProtocol for custom schemes registered with supportFetchAPI enabled but corsEnabled disabled remain script-readable across origins. If untrusted content is loaded within the same session, an attacker can exploit this behavior to bypass the same-origin policy and read sensitive application data, resulting in information disclosure.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,41.10.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[42.0.0-alpha.1,42.9.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[43.0.0-alpha.1,43.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[44.0.0-alpha.1,44.0.0-beta.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "electron", "source": "cna", "vendor": "electron"}, "product": "electron", "vendor": "electron"}], "created": "2026-09-29T23:30:19.056609+00:00", "updated": "2026-09-30T00:30:17.398700+00:00", "vendors": ["electron", "electron$PRODUCT$electron"]}