Executive brief
Electron is a framework used to build desktop applications like Slack, Discord, and VS Code. On macOS, a security flaw allows a local attacker to trick an Electron application into believing it was launched by a trusted source. If successful, the attacker can run unauthorized code with the same permissions as the application, potentially gaining access to the user's keychain, passwords, and sensitive system permissions.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in Electron's macOS implementation of parent process validation. When fuse-based hardening is enabled to restrict 'ELECTRON_RUN_AS_NODE' and 'NODE_OPTIONS' to same-signed parents, the validation mechanism relied on PIDs which could be spoofed or recycled by a local process. An attacker with local access can exploit this to execute arbitrary code within the context of a signed Electron application, inheriting its Transparency, Consent, and Control (TCC) entitlements. The fix involves migrating from PID-based checks to using audit tokens for robust identity verification. Patches are available in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
Affected products
- Electron electron < 39.8.8, 40.x < 40.9.0, 41.x < 41.2.1, 42.x < 42.0.0-beta.3
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory