# CVE-2026-70597: Electron code-signing bypass in macOS parent process validation

Source: https://junglewise.ai/threats/cve-2026-70597-electron-code-signing-bypass-in-macos-parent-process-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-08-05  
License: CC BY 4.0 with a link back

CVE-2026-70597 · Severity: medium · CVSS 6.3 · Published 2026-08-05

Electron is a framework used to build desktop applications like Slack, Discord, and VS Code. On macOS, a security flaw allows a local attacker to trick an Electron application into believing it was launched by a trusted source. If successful, the attacker can run unauthorized code with the same permissions as the application, potentially gaining access to the user's keychain, passwords, and sensitive system permissions.

Technologies: [electron (npm)](https://junglewise.ai/threats/technologies/electron). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-70597 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70597 being exploited in the wild.

**How severe is CVE-2026-70597?** Medium severity, with a CVSS score of 6.3, published 5 August 2026.

**Which products and versions are affected?** electron (npm) SEMVER:introduced=0,fixed=39.8.8.

**Is there a fix for CVE-2026-70597?** Yes. electron (npm): upgrade to 39.8.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70597 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-70597?** Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- electron (npm): upgrade to 39.8.8 or later

  ```sh
  npm install electron@39.8.8
  ```


## Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in Electron's macOS implementation of parent process validation. When fuse-based hardening is enabled to restrict 'ELECTRON_RUN_AS_NODE' and 'NODE_OPTIONS' to same-signed parents, the validation mechanism relied on PIDs which could be spoofed or recycled by a local process. An attacker with local access can exploit this to execute arbitrary code within the context of a signed Electron application, inheriting its Transparency, Consent, and Control (TCC) entitlements. The fix involves migrating from PID-based checks to using audit tokens for robust identity verification. Patches are available in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

## Affected products

- Electron electron < 39.8.8, 40.x < 40.9.0, 41.x < 41.2.1, 42.x < 42.0.0-beta.3

## Identifiers

- CVE-2026-70597
- GHSA-jm7p-cc5g-qwxx

## Timeline

- 2026-07-27: disclosed
- 2026-08-05: advisory

## References

- [https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx](https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx)
- [https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35](https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35)
- [https://api.github.com/repos/electron/electron/security-advisories/GHSA-jm7p-cc5g-qwxx](https://api.github.com/repos/electron/electron/security-advisories/GHSA-jm7p-cc5g-qwxx)

## Related threats

- [Electron certificate blocklist bypass in Node.js TLS](https://junglewise.ai/threats/cve-2026-115570-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114124-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron: Frame subscription trusts GPU-supplied frame geometry](https://junglewise.ai/threats/cve-2026-114122-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron external protocol permission misattribution](https://junglewise.ai/threats/cve-2026-114121-electron-is-a-framework-for-writing-cross-platform-desktop)
- [Electron HID/USB permission checks origin spoofing in iframes](https://junglewise.ai/threats/cve-2026-113800-electron-hid-and-usb-permission-checks-can-be-attributed-to-the)