A flaw was found in Electron. When an application registers a custom scheme using file or HTTP protocol handlers with Fetch API support enabled but Cross-Origin Resource Sharing (CORS) disabled, responses remain script-readable across origins. If untrusted content is loaded within the same session, an attacker can exploit this vulnerability to bypass origin restrictions and read sensitive application data, resulting in information disclosure.
Fix evidence last checked: 2026-10-01 16:37 UTC