CVE-2026-102675

[CVE catalog]

Severity

High · CVSS 7.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Published

Sep 29, 2026, 4:54:29 PM UTC

Updated

Sep 29, 2026, 5:17:07 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.21% · Oct 27, 2026

A flaw was found in Electron. When an application registers a custom scheme using file or HTTP protocol handlers with Fetch API support enabled but Cross-Origin Resource Sharing (CORS) disabled, responses remain script-readable across origins. If untrusted content is loaded within the same session, an attacker can exploit this vulnerability to bypass origin restrictions and read sensitive application data, resulting in information disclosure. electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlers A flaw was found in Electron where responses served via protocol.registerFileProtocol or protocol.registerHttpProtocol for custom schemes registered with supportFetchAPI enabled but corsEnabled disabled remain script-readable across origins. If untrusted content is loaded within the same session, an attacker can exploit this behavior to bypass the same-origin policy and read sensitive application data, resulting in information disclosure. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.