EUVD-2026-53403
GHSA-jm7p-cc5g-qwxx
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Local-only TOCTOU race requires PR:L account and AC:H timing; C:H and I:H reflect TCC and keychain inheritance; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
AnalysisAI
Parent process code-sign spoofing in Electron on macOS allows a local low-privileged attacker to bypass fuse-based hardening controls restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS, injecting code inside the signed Electron application and inheriting its TCC permissions and keychain access. Only macOS deployments of Electron apps that have explicitly enabled same-signed-parent fuse restrictions are exposed; applications without this hardening are unaffected. No public exploit has been identified at time of analysis, and CVSS AC:H reflects the PID-reuse race-condition timing requirement inherent to the attack.
Technical ContextAI
This is a TOCTOU race condition (CWE-367) in Electron's macOS parent-process identity verification. The original code in shell/app/node_main.cc called getppid() to obtain the parent PID, then passed that PID to shell/common/mac/codesign_util.cc using kSecGuestAttributePid with Apple's Security framework to compare code signatures. PIDs are ephemeral - once the legitimate parent exits, its PID can be recycled by an attacker-controlled process, causing Electron to evaluate the attacker's code signature in place of the true parent's. The fix switches to macOS audit tokens (audit_token_t), retrieved via task_name_for_pid() and TASK_AUDIT_TOKEN, which are bound to a single process instance incorporating a per-exec version counter and cannot be spoofed by PID reuse or exec-into-different-image attacks. The lookup attribute changes from kSecGuestAttributePid to kSecGuestAttributeAudit. CPE cpe:2.3:a:electron:electron covers all affected npm/electron package versions prior to the patched releases.
RemediationAI
Update the Electron dependency to a patched version: 39.8.8 (39.x branch), 40.9.0 or 40.9.1 (40.x branch - see note in confidence section), 41.2.1 (41.x branch), or 42.0.0-beta.3 (42.x pre-release). App developers must rebuild and redistribute their Electron-based applications using the patched Electron version. Per the official GHSA advisory, there are no application-side workarounds - the fix is exclusively in the Electron runtime itself and must be taken as an Electron version upgrade. As a conditional risk-reduction measure only, organizations may assess whether the affected fuse-based same-signed-parent flags are actually enabled in their deployments; if they are not enabled, the specific attack path described in this CVE is not present. However, disabling those fuse flags is not recommended as a mitigation because it removes an active security hardening control. Full advisory at https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx and fix commit at https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35.
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. Rated hi
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values
electron-updater allows for automatic updates for Electron apps. Rated high severity (CVSS 7.5), this vulnerability is r
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Native code execution outside the Chromium sandbox is achievable in Electron prior to 39.8.9, 40.9.2, 41.2.1, and 42.0.0
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Rated c
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. Rated crit
Prototype pollution via Electron's contextBridge allows untrusted renderer-side web content to smuggle a malicious proto
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Rated critical severity
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today