CVE-2026-70597 Details
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
A vulnerability exists in Electron applications on macOS that allows a local process to bypass the framework's check to ensure it was launched by a same-signed parent process. This issue affects Electron versions prior to 39.8.8, 40.0.0-alpha.1 through 40.9.0, 41.0.0-alpha.1 through 41.2.1, and 42.0.0-alpha.1 through 42.0.0-beta.3. The bypass can be exploited by apps that enable fuse-based hardening, which restricts 'ELECTRON_RUN_AS_NODE' and 'NODE_OPTIONS' to same-signed parents. A local attacker could exploit this to execute code within the signed app, gaining access to its TCC permissions and keychain data.
Users should update to Electron versions 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |