CVE-2026-102672: Electron: Local race condition in Squirrel.Mac update installation on macOS
On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application’s files, as root, instead of the app that started the update. Exploitation requires local access to the machine.
Apps are only affected on macOS if they ship Squirrel.Mac-based auto-updates. Apps on other platforms, or that do not use Squirrel.Mac auto-updates, are not affected.
References
- github.com/advisories/GHSA-vv43-5jgx-7qv8
- github.com/electron/electron/commit/01faabfc250801a980fc94d64608046c67fc1cd9
- github.com/electron/electron/commit/15e2928a5c5f01759107b414010e220d90d59cef
- github.com/electron/electron/commit/a0f9ff4cc0340545008424232d49caadd9c0c767
- github.com/electron/electron/commit/b8f25c4cedb2e0f5f475912b709aba19c57c26be
- github.com/electron/electron/pull/50745
- github.com/electron/electron/releases/tag/v39.8.10
- github.com/electron/electron/releases/tag/v41.10.5
- github.com/electron/electron/releases/tag/v42.0.0-beta.2
- github.com/electron/electron/security/advisories/GHSA-vv43-5jgx-7qv8
- nvd.nist.gov/vuln/detail/CVE-2026-102672
Code Behaviors & Features
Detect and mitigate CVE-2026-102672 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →