--- title: "CVE-2026-102675: Electron - Stored XSS" description: "Electron < 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 contains a stored XSS caused by improper CORS configuration in custom protocol schemes with supportFetchAPI enabled and corsEnabled disabled, letting attackers read scripts across origins, exploit requires exposing such a scheme and loading untrusted content in the same session." url: https://panop.io/threat-heartbeat/CVE-2026-102675/ --- # CVE-2026-102675 Electron - Stored XSS Electron < 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 contains a stored XSS caused by improper CORS configuration in custom protocol schemes with supportFetchAPI enabled and corsEnabled disabled, letting attackers read scripts across origins, exploit requires exposing such a scheme and loading untrusted content in the same session. CVSS base score 7.4 /10 High CISA KEV Not listed Public exploit None known Authentication Not required EPSS 0.21% chance of exploitation in 30 days [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-102675) ## Details Type Stored XSS Impact Client Script Exec, Information Disclosure CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Published 29 September 2026 Updated 15 October 2026 Weakness [CWE-346](https://cwe.mitre.org/data/definitions/346.html) ## Vendor fix Update to versions 41.10.6, 42.9.2, 43.4.1, or 44.0.0-beta.5 or later. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-102675](https://nvd.nist.gov/vuln/detail/CVE-2026-102675) - [https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d](https://github.com/electron/electron/commit/4d2784cc8592471ee2276235b8c2a03efddf937d) - [https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397](https://github.com/electron/electron/commit/c595b05976e7a885465b043d17e00a92fc3c3397) - [https://github.com/electron/electron/releases/tag/v42.9.2](https://github.com/electron/electron/releases/tag/v42.9.2) - [https://github.com/electron/electron/releases/tag/v43.4.1](https://github.com/electron/electron/releases/tag/v43.4.1) - [https://github.com/electron/electron/releases/tag/v44.0.0-beta.5](https://github.com/electron/electron/releases/tag/v44.0.0-beta.5) - [https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d](https://github.com/electron/electron/commit/80178e4631cb2f6a5e42f8e793b2ae9624e78a0d) - [https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2](https://github.com/electron/electron/commit/ef75c4b98caaa3ebc615f1eba302027028ee04d2) - [https://github.com/electron/electron/releases/tag/v41.10.6](https://github.com/electron/electron/releases/tag/v41.10.6) - [https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj](https://github.com/electron/electron/security/advisories/GHSA-j84w-jfhq-vhvj) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)