CVE-2026-102675

Executive Summary

CVE-2026-102675 is a cross-origin data exposure vulnerability in the Electron framework affecting custom protocol handlers registered with supportFetchAPI enabled but corsEnabled disabled. Responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for such schemes could remain script-readable across origins, allowing an attacker-controlled origin to read response content intended to be isolated. Applications are affected only when they expose such a scheme and load untrusted content in the same session. This issue completes the remediation for CVE-2026-70604 and is rated CVSS 7.4, reflecting high confidentiality impact with no integrity or availability impact.

Technical Analysis

Electron allows applications to register custom schemes and to serve responses for those schemes through APIs such as protocol.registerFileProtocol and protocol.registerHttpProtocol. Two scheme properties govern cross-origin access: supportFetchAPI and corsEnabled. When a scheme is registered with supportFetchAPI enabled but corsEnabled disabled, the intent is that scheme responses are not cross-origin readable. Prior to the fixed versions, responses served through the file and HTTP protocol registration APIs for such a scheme "could remain script-readable across origins."

The root cause is classified as CWE-346 (Origin Validation Error): the enforcement of the intended origin restriction was incomplete, leaving a residual path by which a script executing in a different origin could read the response body. The description explicitly notes this is the completion of remediation for CVE-2026-70604, indicating an earlier fix that did not fully close the cross-origin readability path. Notably, schemes intentionally registered with corsEnabled enabled remain cross-origin readable by design — the defect is confined to schemes where cross-origin readability was meant to be disallowed.

The attack surface is the Electron protocol/scheme layer, specifically the interaction between the Fetch API support flag and the CORS enablement flag during response delivery. No function names, endpoints, or parameters beyond those in the NVD description are asserted here. The vulnerability affects Electron releases prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5.

Exploitation Scenarios

Exploitation requires a specific pre-condition: the target Electron application must expose a custom scheme via protocol.registerFileProtocol or protocol.registerHttpProtocol, that scheme must be registered with supportFetchAPI enabled and corsEnabled disabled, and the application must load untrusted content in the same session.

1. Reconnaissance/target identification: An attacker identifies an Electron desktop application that registers a custom scheme matching the vulnerable configuration and that renders untrusted or attacker-influenceable content (for example, remote web content or user-supplied content) within the same Electron session. No public PoC is available; the attack chain is inferred from the vulnerability class (cross-origin origin-validation failure).

2. Triggering the flaw class: Attack content executes script in an origin that is distinct from the custom scheme's origin. Because the scheme was registered with corsEnabled disabled, the intent is a same-origin policy boundary. The origin validation enforcing that boundary is incomplete, so a cross-origin read of scheme-served responses remains possible.

3. Payload/execution at the vulnerability-class level: Instead of a standard blocked cross-origin request, the malicious script issues a request (via the Fetch API surface associated with the scheme) and is able to read the response content that should have been restricted. This is a data-read primitive, not code execution or write access.

4. Post-exploitation impact: The attacker exfiltrates the content of responses readable from the custom scheme's origin. Depending on what that scheme serves, this could disclose application data, configuration, or local file content surfaced through the file protocol handler. Integrity and availability are unaffected (CVSS I:N/A:N); impact is confidentiality-only (C:H).

Impact Assessment

CVE-2026-102675 carries a CVSS v3.1 base score of 7.4 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. The network attack vector and low attack complexity make exploitation straightforward once the vulnerable configuration is present; no privileges are required. User interaction is required (UI:R), consistent with the need for the victim to load or interact with untrusted content in the same session. The scope change (S:C) reflects that the vulnerability in the protocol layer impacts resources beyond its original security scope — an origin boundary is violated. Confidentiality impact is High; integrity and availability are None.

The blast radius is limited to applications that meet all pre-conditions: exposing a custom scheme via the identified registration APIs with supportFetchAPI enabled and corsEnabled disabled, and loading untrusted content in the same session. Electron is widely used for cross-platform desktop applications built with JavaScript, HTML, and CSS, so affected deployments can appear in virtually any sector. Because the flaw is a residual of CVE-2026-70604, applications that already applied the earlier fix may still be exposed. There is no evidence of public PoC, exploit code, or CISA KEV listing, and FIRST.org has not yet assigned an EPSS score.

Detection Guidance

Sigma Rule

title: Electron Custom Scheme Cross-Origin Response Read (CVE-2026-102675)
id: 9f1c3b7a-2d64-4e88-9a10-7c5b0e21d4f3
status: experimental
description: Detects Electron applications loading untrusted remote content in a session that exposes a custom scheme registered with supportFetchAPI enabled and corsEnabled disabled.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-102675
author: valtersit.com
date: 2026/01/01
tags:
    - attack.t1190
    - cve.2026-102675
logsource:
    category: process_creation
    product: windows
detection:
    selection_proc:
        Image|endswith:
            - '\electron.exe'
    selection_args:
        CommandLine|contains:
            - '--remote-debugging'
            - 'file://'
    condition: selection_proc and selection_args
falsepositives:
    - Legitimate developer debugging sessions
level: medium

YARA Rule

rule CVE_2026_102675_Electron_Custom_Scheme_Misconfig
{
    meta:
        description = "Detects Electron application bundles referencing vulnerable custom scheme registration patterns (supportFetchAPI with corsEnabled disabled) associated with CVE-2026-102675"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102675"
        date = "2026-01-01"
        severity = "high"

    strings:
        $api1 = "registerFileProtocol" ascii wide
        $api2 = "registerHttpProtocol" ascii wide
        $flag1 = "supportFetchAPI" ascii wide
        $flag2 = "corsEnabled" ascii wide

    condition:
        filesize < 50MB and
        (($api1 or $api2) and $flag1 and $flag2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102675 Electron custom scheme cross-origin response read attempt"; flow:to_client,established; content:"Access-Control-Allow-Origin"; http_header; content:"Origin"; http_header; classtype:attempted-recon; reference:cve,2026-102675; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102675; sid:2026102675; rev:1;)

Elastic Detection

process where event.type == "start" and
 process.name : ("electron.exe", "electron") and
 process.command_line : "*--remote-debugging*"

Splunk SPL Query

index=endpoint (process_name=electron.exe OR process_name=electron)
| where match(command_line, "(?i)registerFileProtocol|registerHttpProtocol|supportFetchAPI|remote-debugging")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, command_line
| where count > 0

Wazuh OSSEC Rule

<group name="electron,cve-2026-102675,">
  <rule id="100675" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">electron</field>
    <field name="process.command_line">\.(registerFileProtocol|registerHttpProtocol|supportFetchAPI)</field>
    <description>CVE-2026-102675: Electron process exhibiting custom scheme registration activity related to cross-origin response exposure</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Audit all Electron applications in the environment for custom schemes registered via protocol.registerFileProtocol or protocol.registerHttpProtocol.
• For any such scheme that does not strictly require cross-origin readability, avoid the vulnerable combination of supportFetchAPI enabled with corsEnabled disabled, or otherwise restrict the scheme so untrusted content is never loaded in the same session.
• Isolate untrusted content into separate sessions/partitions so attacker-influenced origins cannot share a session with the exposed scheme.
• Note that schemes intentionally registered with corsEnabled enabled are cross-origin readable by design; review whether that design is required.

2. Patch/upgrade steps:

• Upgrade Electron to 41.10.6, 42.9.2, 43.4.1, or 44.0.0-beta.5 (or later within the respective release lines), which contain the fix per the NVD description.
• Because this issue completes remediation for CVE-2026-70604, organizations that applied only the earlier fix should verify they have moved to a version that includes this residual correction.

3. Long-term hardening:

• Establish a scheme-registration policy that explicitly documents which schemes are cross-origin readable and why.
• Track Electron release channels for security fixes and treat framework upgrades as security-critical given the broad desktop deployment footprint.
• Continuously inventory packaged Electron applications and their bundled framework versions.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102675
• Related prior CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-70604
• Electron project releases and security guidance: https://www.electronjs.org/
• CWE-346 Origin Validation Error: https://cwe.mitre.org/data/definitions/346.html
• No public PoC, exploit code, or CISA KEV listing is available for CVE-2026-102675 at the time of writing; no known threat actor campaigns or in-the-wild exploitation have been reported.