A vulnerability in the Electron framework allows remote origins to bypass CORS enforcement when a custom scheme is registered with supportFetchAPI: true but without corsEnabled: true. This means a page loaded from a remote origin can use fetch() or XMLHttpRequest to read the full response body from that custom scheme cross-origin, bypassing expected access restrictions. Applications that serve sensitive data via such custom schemes and load remote or untrusted content in a renderer process are at risk. The vulnerability affects Electron versions prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0. Fixes have been released in those respective versions. Developers using Electron with custom schemes and remote content should update immediately to mitigate potential data exposure.