AIKIDO-2026-322648
electron is vulnerable to Origin Validation Error
74
High Risk
This Affects:
electronTL;DR
Custom protocol schemes registered with protocol.registerFileProtocol or protocol.registerHttpProtocol and supportFetchAPI: true but without corsEnabled: true still let their responses be read cross-origin by web content. This affects apps that register such a scheme, serve it through one of those handlers, and load untrusted content in the same session; corsEnabled: true is not a mitigation since that option opts a scheme in to cross-origin reads by design. The fix enforces the CORS restriction for schemes that did not opt in to corsEnabled.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you serve a custom protocol scheme through protocol.registerFileProtocol or protocol.registerHttpProtocol alongside untrusted content in the same session.
Background info
electron is vulnerable to Origin Validation Error in versions 1.0.0 - 41.10.5, 42.0.0 - 42.9.1 and 43.0.0 - 43.4.0.
How to fix this
Upgrade the electron library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.