AIKIDO-2026-322648
electron is vulnerable to Origin Validation Error
74
CVE Score
High
Origin Validation Error
TL;DR
Custom protocol schemes registered with protocol.registerFileProtocol or protocol.registerHttpProtocol and supportFetchAPI: true but without corsEnabled: true still let their responses be read cross-origin by web content. This affects apps that register such a scheme, serve it through one of those handlers, and load untrusted content in the same session; corsEnabled: true is not a mitigation since that option opts a scheme in to cross-origin reads by design. The fix enforces the CORS restriction for schemes that did not opt in to corsEnabled.
How do I fix this?
Upgrade the electron library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you serve a custom protocol scheme through protocol.registerFileProtocol or protocol.registerHttpProtocol alongside untrusted content in the same session.
Package
Versions
1.0.0 - 41.10.5
Fixed in 41.10.642.0.0 - 42.9.1
Fixed in 42.9.243.0.0 - 43.4.0
Fixed in 43.4.1Background info
electron is vulnerable to Origin Validation Error in versions 1.0.0 - 41.10.5, 42.0.0 - 42.9.1 and 43.0.0 - 43.4.0.
Links
GitHub Releases
github.com/electron/electron/releases/tag/v42.9.2github.com/electron/electron/releases/tag/v41.10.6github.com/electron/electron/releases/tag/v43.4.1github.com/electron/electron/releases/tag/v44.0.0-beta.5Fix Commits
github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937dgithub.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0dgithub.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.