Local Race Vulnerability in Electron Framework for MacOS Applications
CVE-2026-102672
What is CVE-2026-102672?
The Electron framework, used for creating cross-platform desktop applications, has a vulnerability in which applications on macOS utilizing Squirrel.Mac for automatic updates may face a local race condition. This flaw arises from the ShipIt helper failing to restrict the validated update target to a single canonical application-bundle path. Consequently, an attacker could exploit this issue to redirect write operations, potentially overwriting files belonging to other applications instead of the intended one. This vulnerability impacts specific versions and is addressed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.
Affected Version(s)
electron < 39.8.10 < 39.8.10
electron >= 40.0.0-alpha.1, < 41.10.5 < 40.0.0-alpha.1, 41.10.5
electron >= 42.0.0-alpha.1, < 42.0.0-beta.2 < 42.0.0-alpha.1, 42.0.0-beta.2