From the release notes [1]:
* Fix a vulnerability caused by Cross-Origin Resource Sharing (CORS)
in the JSONRPC interface. Previous versions of Electrum are
vulnerable to port scanning and deanonimization attacks from
malicious websites. Wallets that are not password-protected are
vulnerable to theft.
See this [2] for explanation.
[1] https://github.com/spesmilo/electrum/blob/3.0.4/RELEASE-NOTES
[2] https://github.com/spesmilo/electrum/issues/3374
207bf49c8d