{"vulnerability": "cve-2026-7060", "sightings": [{"uuid": "ade69e09-f5de-4510-ba07-0dc498ec4e2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70604", "type": "seen", "source": "https://gist.github.com/alon710/833f29b9d380bcf059ea629581974a6e", "content": "# CVE-2026-70604: CVE-2026-70604: Cross-Origin Resource Sharing (CORS) Bypass in Electron Custom Schemes\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70604\n\n## Summary\nElectron custom schemes registered with supportFetchAPI: true but without corsEnabled: true failed to apply CORS enforcement in versions prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0. This mapping discrepancy allowed malicious remote pages to issue cross-origin requests, read sensitive local response data, and bypass Same-Origin Policy (SOP) mechanisms.\n\n## TL;DR\nElectron custom protocols lacked CORS checks when supportFetchAPI was enabled without explicit corsEnabled configurations. This permitted remote pages to read sensitive local assets cross-origin.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-942: Permissive Cross-domain Policy with Untrusted Domains\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.4 (High Severity)\n- **Exploit Status**: PoC (Proof-of-Concept) Available\n- **KEV Status**: Not Listed\n- **Impact**: Confidentiality Bypass / Same-Origin Policy (SOP) Break\n\n## Affected Systems\n\n- Electron Framework\n- **Electron**: < 39.8.10 (Fixed in: `39.8.10`)\n- **Electron**: >= 40.0.0, < 40.9.3 (Fixed in: `40.9.3`)\n- **Electron**: >= 41.0.0, < 41.4.0 (Fixed in: `41.4.0`)\n- **Electron**: >= 42.0.0, < 42.0.0 (Fixed in: `42.0.0`)\n\n## Mitigation\n\n- Upgrade Electron to patched releases\n- Explicitly set corsEnabled: true on custom protocols\n- Disable supportFetchAPI if network requests to the protocol are unnecessary\n- Implement robust Content Security Policies (CSP) to restrict data exfiltration\n\n**Remediation Steps:**\n1. Identify all occurrences of protocol.registerSchemesAsPrivileged in the application's Main Process\n2. Verify if supportFetchAPI is set to true\n3. Ensure corsEnabled is explicitly declared as true for those protocols\n4. Update Electron dependency in package.json to at least 39.8.10, 40.9.3, 41.4.0, or 42.0.0\n5. Rebuild and redeploy the application\n\n## References\n\n- [GitHub Security Advisory GHSA-v3j7-r9gq-3gjw](https://github.com/electron/electron/security/advisories/GHSA-v3j7-r9gq-3gjw)\n- [CVE-2026-70604 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-70604)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70604) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T16:31:30.156301Z"}, {"uuid": "004f2b3a-2437-4f29-83f3-c5f9359874e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70607", "type": "seen", "source": "https://gist.github.com/alon710/9a7a5a858022e3c656feab4ec8f0d30d", "content": "# CVE-2026-70607: CVE-2026-70607: Privileged Option Injection in Electron window.open Features\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70607\n\n## Summary\nAn input validation vulnerability in the Electron desktop framework allows untrusted web content running in a renderer process to inject privileged configuration options when creating child windows via window.open. Under Windows environments, this allows attackers to pass a remote Universal Naming Convention (UNC) path to the window icon configuration parameter, forcing the host system to make an SMB connection to a remote listener and leak the current user's NetNTLM authentication hash.\n\n## TL;DR\nAn input validation vulnerability in Electron's window.open features parsing allows untrusted JavaScript to control privileged browser window options. This allows attackers to force UNC path loading, leaking Windows authentication hashes via SMB.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: Not Available\n- **Impact**: Information Disclosure (NetNTLM Hash Leak)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Electron Desktop Applications running on Windows\n- **electron**: < 39.8.8 (Fixed in: `39.8.8`)\n- **electron**: >= 40.0.0-alpha.1, < 40.9.0 (Fixed in: `40.9.0`)\n- **electron**: >= 41.0.0-alpha.1, < 41.2.1 (Fixed in: `41.2.1`)\n- **electron**: >= 42.0.0-alpha.1, < 42.0.0-beta.3 (Fixed in: `42.0.0-beta.3`)\n\n## Mitigation\n\n- Upgrade Electron to a patched version immediately.\n- Use setWindowOpenHandler to sanitize or reject client-side window options.\n- Apply strict Content Security Policies to block unauthorized JavaScript execution.\n\n**Remediation Steps:**\n1. Identify vulnerable Electron instances in package.json.\n2. Update Electron dependencies to 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3.\n3. Configure setWindowOpenHandler on the main process to validate and override client-supplied options.\n4. Validate that incoming requests cannot load remote UNC paths.\n\n## References\n\n- [GHSA-v93f-fgjr-hjrj Security Advisory](https://github.com/electron/electron/security/advisories/GHSA-v93f-fgjr-hjrj)\n- [Fix Commit 30cf3882de75ee651bd4e5f27002f13fd3d3163a](https://github.com/electron/electron/commit/30cf3882de75ee651bd4e5f27002f13fd3d3163a)\n- [CVE-2026-70607 Record](https://www.cve.org/CVERecord?id=CVE-2026-70607)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70607) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T17:33:01.781718Z"}]}