Electron EUVD-2026-98837

Exploitation requires ALL of: (1) macOS as the platform; (2) the Electron app must ship Squirrel.Mac-based auto-updates - apps not using Squirrel.Mac or on other OSes are unaffected; (3) local access to the machine as an existing user (PR:L); (4) an update install must occur so the privileged ShipIt helper runs as root (UI:R); and (5) winning a TOCTOU race window (AC:H) to swap the target bundle path between validation and the root-privileged write. There is no app-side workaround - only upgrading Electron to 39.8.10, 41.10.5, or 42.0.0-beta.2 remediates it. These prerequisites (local + macOS + Squirrel.Mac + race) sharply limit realistic exploitation despite the high impact.

This is a genuine local privilege-escalation issue but not an urgent remote-exploitation priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R/S:U) confirms local-only access, high attack complexity (a TOCTOU race per CWE-367), an already-authenticated low-privileged local user, and required user interaction (an update must be initiated). The 6.7 base score is driven entirely by the C:H/I:H/A:H impacts, which follow logically from a root-privileged helper (ShipIt) being coerced into overwriting an arbitrary application's files - a strong integrity/privesc primitive that can cascade to code execution and thus confidentiality and availability. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so this is no public exploit identified at time of analysis. The high attack complexity (winning a race window) plus the local + macOS-only + Squirrel.Mac-auto-update prerequisites substantially narrow real-world exploitability versus the raw score. The CVSS vector is internally consistent with the description (both indicate local access), so no signal conflict is present; the main caveat is that the 'Information Disclosure' tag does not match the actual impact (arbitrary root file overwrite is primarily an integrity/privesc issue).

A local low-privileged user on a shared or already-compromised Mac stages a malicious symlink/path condition and triggers (or waits for) a Squirrel.Mac auto-update of an Electron app. Because the root ShipIt helper re-resolves the untrusted target bundle path from the on-disk request during the install, the attacker wins the race and redirects the root-privileged file write to a different application's bundle, achieving privilege escalation. No public exploit is identified, and success depends on winning a TOCTOU race window (AC:H).