diff --git a/main.ts b/main.ts
index 3298a0b1..08d61f6a 100644
--- a/main.ts
+++ b/main.ts
@@ -416,7 +416,11 @@ async function subscribeBackendEventsForWebContents(webContents: WebContents) {
             .map((line) => line.slice("data: ".length))
             .join("\n");
           if (data && !webContents.isDestroyed()) {
-            webContents.send("backend:event", JSON.parse(data));
+            try {
+              webContents.send("backend:event", JSON.parse(data));
+            } catch {
+              console.warn("Skipping malformed SSE event from backend");
+            }
           }
           boundary = buffer.indexOf("\n\n");
         }
diff --git a/main/backend-sidecar.ts b/main/backend-sidecar.ts
index 4d081db9..47ec2246 100644
--- a/main/backend-sidecar.ts
+++ b/main/backend-sidecar.ts
@@ -328,7 +328,7 @@ export function createBackendSidecarController(options: CreateBackendSidecarCont
         OPENGUI_AUTH_TOKEN: token,
         OPENGUI_ALLOWED_ROOTS: process.env.OPENGUI_ALLOWED_ROOTS || dependencies.homedir(),
         OPENGUI_DATA_DIR: dataDir,
-        OPENGUI_CORS_ORIGIN: process.env.OPENGUI_CORS_ORIGIN || "*",
+        OPENGUI_CORS_ORIGIN: process.env.OPENGUI_CORS_ORIGIN || "http://localhost:3000",
         OPENGUI_MODE: "desktop-sidecar",
         OPENGUI_SERVER_MODE: "desktop-sidecar",
       },