CVE-2026-102675 Electronjs CVE debrief

Who should care

Defenders of Electron applications, particularly those using custom protocol handlers or loading untrusted content, should assess exposure and prioritize remediation. This includes developers and security teams responsible for maintaining Electron-based applications, especially in environments where untrusted content is routinely loaded.

Why it matters

CVE-2026-102675 is a high-severity issue in Electron that allows cross-origin readability of responses served through custom protocols under certain conditions. Defenders should prioritize verifying configurations, reviewing untrusted content loading, and upgrading to fixed versions to mitigate potential script access across origins.

• Defenders must verify Electron application configurations for custom protocol registrations and untrusted content loading.
• Remediation requires upgrading to fixed Electron versions: 41.10.6, 42.9.2, 43.4.1, or 44.0.0-beta.5.
• Cross-origin readability could allow unintended script access across origins.
• Compensating controls may be necessary for applications unable to upgrade immediately.

Technical summary

CVE-2026-102675 is a high-severity issue in Electron, a framework for building cross-platform desktop applications. Prior to versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for custom schemes with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This issue affects applications that expose such a scheme and load untrusted content in the same session. The issue has been fixed in the mentioned versions.

Defensive priority

Defenders should prioritize verifying Electron application configurations, reviewing custom protocol registrations, and ensuring upgrades to fixed versions.

Recommended defensive actions

• Verify Electron application configurations for custom protocol registrations.
• Review applications for untrusted content loading in the same session as custom protocol usage.
• Upgrade to Electron versions 41.10.6, 42.9.2, 43.4.1, or 44.0.0-beta.5.
• Monitor for unusual script activity across origins in Electron applications.
• Implement compensating controls for cross-origin readability.

Evidence notes

The issue involves responses served through custom protocols in Electron applications, which could remain script-readable across origins under certain conditions. This was fixed in Electron versions 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.