Local Process Bypass in Electron Framework on macOS

CVE-2026-70597

What is CVE-2026-70597?

A vulnerability in the Electron framework prior to specific versions allows a local attacker to bypass verification checks on macOS. The issue stems from an inadequate safeguard that is supposed to confirm that Electron was launched by a same-signed parent process. Attackers could potentially exploit this to execute arbitrary code within the context of a signed application, inheriting sensitive permissions such as those granted by the Transparency, Consent, and Control (TCC) framework and accessing the keychain. Users are encouraged to upgrade to the latest versions to mitigate this security risk.

References