Electron EUVD-2026-53403

Four concrete prerequisites must all be met: (1) macOS platform only - this vulnerability does not affect Electron on Windows or Linux; (2) the target Electron application must have explicitly enabled the fuse-based hardening that restricts ELECTRON_RUN_AS_NODE and/or NODE_OPTIONS to same-signed parent processes - applications without this fuse configuration enabled are explicitly not affected per the vendor advisory; (3) the attacker must have local code execution as a low-privileged user (PR:L) on the same macOS system as the target application; (4) successful exploitation requires winning a TOCTOU timing race - the attacker must recycle the legitimate parent's PID between Electron's getppid() call and the kSecGuestAttributePid Security framework lookup, demanding precise timing or repeated attempts (reflected in AC:H). The limiting factors - local access only, non-default hardening opt-in required, and race-condition complexity - substantially reduce the realistic attack population beyond what the C:H/I:H impact scores suggest in isolation.

CVSS 6.3 (Medium) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N accurately represents this vulnerability. The local-only attack vector (AV:L) and high attack complexity (AC:H) significantly constrain exploitability: the attacker must control PID recycling timing on the same macOS host within a narrow race window. Despite those constraints, the C:H and I:H scores are well-justified - successful exploitation yields TCC entitlement inheritance (camera, microphone, contacts, location) and full keychain access of the target signed application, which can be extremely high-value targets. No EPSS score was supplied in the input data; exploitation probability is therefore inferred from the attack complexity and the absence of any CISA KEV listing. No public POC has been identified at time of analysis. The real-world attack surface is further narrowed to macOS only and to Electron apps that have opted into the fuse-based same-signed-parent hardening - a non-default, security-conscious configuration. This makes opportunistic mass exploitation unlikely, but targeted attacks against high-value Electron apps (password managers, developer tools with secrets access) are plausible for a motivated local attacker.

A local attacker with a low-privileged shell on macOS targets an Electron application that has enabled same-signed-parent fuse restrictions (such as a password manager or developer tool with broad TCC permissions). The attacker launches a controlled process as the parent of the Electron app, then forces the parent to exit and immediately races to recycle the same PID with an attacker-controlled unsigned or differently-signed process. In the narrow TOCTOU window between Electron's getppid() call and the Security framework's code-signature lookup, Electron approves the attacker's process as a same-signed parent, allowing the attacker to supply ELECTRON_RUN_AS_NODE or NODE_OPTIONS and execute arbitrary Node.js code inside the signed app - inheriting its keychain access and TCC entitlements. No public POC has been identified at time of analysis.