| Package | Affected versions | Patched versions |
|---|---|---|
| electron | = 42.0.0≥ 40.0.0, < 40.9.3≥ 41.0.0, < 41.4.0< 39.8.10 | 40.9.341.4.039.8.10 |
| electron | ≥ 40.0.0-alpha.1, < 40.9.3≥ 41.0.0-alpha.1, < 41.4.0≥ 42.0.0-alpha.1, < 42.0.0< 39.8.10 | 40.9.341.4.042.0.039.8.10 |
A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked.
Apps that serve sensitive data from such a scheme and load remote or untrusted content in a renderer are affected. Apps that set corsEnabled: true, or that do not load untrusted content, are not affected.
Set corsEnabled: true on schemes that must enforce CORS, and validate the request Origin in your protocol handler before returning sensitive data.
42.0.041.4.040.9.339.8.10If you have any questions or comments about this advisory, email Electron at [email protected]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free