| Package | Affected versions | Patched versions |
|---|---|---|
| electron | = 44.0.0≥ 42.0.0, < 42.9.2≥ 43.0.0, < 43.4.1< 41.10.6 | 42.9.243.4.141.10.6 |
| electron | ≥ 42.0.0-alpha.1, < 42.9.2≥ 43.0.0-alpha.1, < 43.4.1≥ 44.0.0-alpha.1, < 44.0.0-beta.5< 41.10.6 | 42.9.243.4.144.0.0-beta.541.10.6 |
Responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI: true but without corsEnabled: true could be read cross-origin by web content. This completes the fix for CVE-2026-70604.
Apps are only affected if they register such a scheme, serve it through one of those handlers, and load untrusted content. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.
Set corsEnabled: true on the scheme, or do not load untrusted content in windows that can reach it.
44.0.0-beta.543.4.142.9.241.10.6If you have any questions or comments about this advisory, email us at [email protected]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free