A custom protocol scheme that enables the Fetch API but omits CORS enforcement allows an attacker to retrieve the body of responses from that scheme using fetch() or XMLHttpRequest, effectively bypassing the expected same‑origin restriction. The result is a breach of confidentiality for any data served over the vulnerable scheme, classified under CWE‑942.

Electron frameworks installed with versions prior to 39.8.10, 40.9.3, 41.4.0, or 42.0.0 are affected. Applications that register custom protocols with supportFetchAPI set to true and do not enable corsEnabled are at risk when they load remote or untrusted renderer content.

The vulnerability’s CVSS score of 7.4 indicates a high impact with significant risk to data confidentiality. EPSS information is not available, and the flaw is not listed in CISA KEV, suggesting early‑stage exploitation potential. An attacker would need to supply or influence content loaded in a renderer process that can call fetch() or XMLHttpRequest on the custom scheme, a scenario commonly found in apps that integrate remote web content.