CVE-2026-102672

Awaiting Analysis Awaiting Analysis - Queue

Race Condition in Electron macOS Squirrel.Mac Update Mechanism

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2, Electron applications on macOS that use Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper. The helper did not bind the validated update target to one canonical application-bundle path for the full installation, allowing a local attacker to redirect the root-level write so that it overwrites another application's files instead of the application that initiated the update. Applications on other platforms and macOS applications that do not use Squirrel.Mac-based automatic updates are not affected. This issue is fixed in versions 39.8.10, 41.10.5, and 42.0.0-beta.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102672

EUVD

EUVD-2026-98837

Affected Vendors & Products

Vendor	Product	Version / Range
electron	electron	< 39.8.10
electron	electron	>= 40.0.0-alpha.1, < 41.10.5
electron	electron	>= 42.0.0-alpha.1, < 42.0.0-beta.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a local race condition in Electron applications on macOS that use Squirrel.Mac-based automatic updates. The privileged ShipIt helper, running as root, could be manipulated by a local attacker to overwrite files belonging to a different application instead of the intended one during the update process. The issue occurs because the target bundle path was not consistently resolved to a single canonical path throughout the installation.

Detection Guidance

This vulnerability affects only Electron applications on macOS using Squirrel.Mac-based automatic updates. Detection requires checking if your Electron app uses Squirrel.Mac and is running an unpatched version. Verify Electron versions with commands like 'electron --version' or check app bundle info. Monitor for unexpected file modifications or crashes during updates.

Impact Analysis

If exploited, this vulnerability could allow a local attacker to overwrite files of another application on your macOS system during an update. This could lead to data corruption, unauthorized modifications, or even the installation of malicious software under the guise of a legitimate update. Only users of Electron apps on macOS with Squirrel.Mac auto-updates are affected.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing local attackers to overwrite files of other applications during Electron updates on macOS. This may lead to unauthorized data access or modification, violating confidentiality and integrity requirements in these regulations.

Mitigation Strategies

Upgrade Electron to versions 39.8.10, 41.10.5, or 42.0.0-beta.2 or later to patch the vulnerability.
Disable Squirrel.Mac-based automatic updates if not required, especially for macOS applications.
Restrict local user permissions to reduce attack surface for local privilege escalation.
Monitor system logs for suspicious activity during application updates or installations.

Hi! I’m here to help you understand CVE-2026-102672. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70