# CVE-2026-102672: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.

Source: https://junglewise.ai/threats/cve-2026-102672-electron-local-race-condition-in-squirrel-mac-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102672 · Severity: medium · CVSS 6.7 · Published 2026-10-13

Electron, the framework used to build desktop applications like VS Code and Slack, bundles an auto-update system on macOS that runs with root privileges. A local attacker could exploit a race condition to trick this system into overwriting files in a different application instead of updating the intended one, potentially compromising any app on the system. Exploitation requires physical or local network access to the machine.

Technologies: [GitHub Electron](https://junglewise.ai/threats/technologies/github-electron), [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [GitHub](https://junglewise.ai/threats/vendors/github), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-102672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102672 being exploited in the wild.

**How severe is CVE-2026-102672?** Medium severity, with a CVSS score of 6.7, published 13 October 2026.

**Which products and versions are affected?** GitHub Electron < 39.8.10, >= 40.0.0-alpha.1 and < 41.10.5, >= 42.0.0-alpha.1 and < 42.0.0-beta.2; electron (npm) SEMVER:introduced=0,fixed=39.8.10.

**Is there a fix for CVE-2026-102672?** Yes. electron (npm): upgrade to 39.8.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102672 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-102672?** Check whether you run GitHub Electron or electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 39.8.10 or later

  ```sh
  npm install electron@39.8.10
  ```


## Technical details

A time-of-check-time-of-use (TOCTOU) race condition exists in Electron's bundled Squirrel.Mac auto-update framework, specifically in the privileged ShipIt helper that performs final update steps as root. An attacker with local access and low privileges can manipulate filesystem state between the helper's validation check and file installation, causing arbitrary application files to be overwritten with root privileges. The vulnerability affects only macOS deployments using Squirrel.Mac auto-updates.

## Affected products

- GitHub Electron < 39.8.10, >= 40.0.0-alpha.1 and < 41.10.5, >= 42.0.0-alpha.1 and < 42.0.0-beta.2

## Identifiers

- CVE-2026-102672
- GHSA-vv43-5jgx-7qv8

## Timeline

- 2026-08-29: disclosed
- 2026-09-29: advisory
- 2026-08-29: patched: Patches released: 39.8.10, 41.10.5, 42.0.0-beta.2

## References

- [https://api.github.com/users/sgretas](https://api.github.com/users/sgretas)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)