CVE-2026-70597: Electron Framework Auth Bypass Vulnerability

CVE-2026-70597 Overview

CVE-2026-70597 is a time-of-check time-of-use (TOCTOU) vulnerability [CWE-367] in the Electron framework on macOS. Electron is a cross-platform desktop application framework built with JavaScript, HTML, and CSS. The flaw affects the check Electron uses to confirm that its parent process is signed with the same code signature as the current application. A local attacker can bypass this check by exploiting the race between resolving a parent PID and reading its code signature. Successful exploitation allows the attacker to execute code inside a signed Electron app, inheriting its Transparency, Consent, and Control (TCC) permissions and keychain access.

Critical Impact
Local attackers can bypass fuse-based hardening on ELECTRON_RUN_AS_NODE and NODE_OPTIONS, inheriting the target app's TCC permissions and keychain access on macOS.

Affected Products

Electron versions prior to 39.8.8
Electron 40.x prior to 40.9.0
Electron 41.x prior to 41.2.1 and 42.0.0-beta.3

Discovery Timeline

2026-08-05 - CVE-2026-70597 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-70597

Vulnerability Analysis

Electron on macOS enforces a same-signature check to determine whether its parent process shares the current app's code signature. Applications relying on Electron fuses restrict environment variables such as ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents. These fuses harden the app against unsigned callers injecting Node.js execution flags. The pre-patch implementation identified the parent process by calling getppid() and then queried its code signature. Because PIDs are reused and not bound to a single process instance, a local attacker can win a race and substitute a same-signed process during the interval between PID lookup and signature evaluation. Once the check succeeds, the attacker inherits every TCC permission and keychain entry granted to the target Electron application.

Root Cause

The vulnerability stems from using a raw PID as the parent identity in ProcessSignatureIsSameWithCurrentApp(getppid()). PIDs are not stable identifiers on macOS. Another process can occupy the same PID between the check and the use, invalidating the trust decision. This is a classic time-of-check to time-of-use flaw [CWE-367].

Attack Vector

Exploitation requires local access and low privileges. The attacker manipulates process creation to have a same-signed helper occupy the parent PID slot at the moment Electron reads it. Once the check passes, the attacker launches the target Electron binary with attacker-controlled ELECTRON_RUN_AS_NODE or NODE_OPTIONS values, executing arbitrary code inside the signed app.

text

// Security patch: shell/app/node_main.cc
#if BUILDFLAG(IS_MAC)
-  if (!ProcessSignatureIsSameWithCurrentApp(getppid())) {
+  // Capture the parent's audit token as early as possible. The audit token
+  // (unlike a raw PID) is bound to a single process instance.
+  std::optional<audit_token_t> parent_audit_token =
+      GetParentProcessAuditToken();
+  if (!parent_audit_token ||
+      !ProcessSignatureIsSameWithCurrentApp(*parent_audit_token)) {
     // On macOS, it is forbidden to run sandboxed app with custom arguments
     // from another app, i.e. args are discarded in following call:
     //   exec("Sandboxed.app", ["--custom-args-will-be-discarded"])

Source: Electron security patch commit 0a6291a. The fix replaces the PID-based parent identifier with an audit token captured via GetParentProcessAuditToken(). Audit tokens are bound to a single process instance and cannot be recycled, closing the TOCTOU window.

Detection Methods for CVE-2026-70597

Indicators of Compromise

Unexpected child processes of signed Electron applications spawning node-like execution flows with ELECTRON_RUN_AS_NODE=1 set in the environment.
Presence of NODE_OPTIONS values referencing attacker-writable paths passed into signed Electron binaries.
Short-lived same-signed helper processes launched immediately before an Electron binary is executed by a non-standard parent.

Detection Strategies

Monitor macOS EndpointSecurityES_EVENT_TYPE_NOTIFY_EXEC events for Electron apps launched with ELECTRON_RUN_AS_NODE or NODE_OPTIONS set by a non-same-signed grandparent process.
Correlate rapid PID reuse patterns where a process exits and its PID is quickly reassigned before a downstream code-signature check completes.
Alert on Electron apps invoking Node.js entry points outside their normal application launch context.

Monitoring Recommendations

Baseline expected parent-child relationships for each installed Electron application and flag deviations.
Track access to sensitive TCC-protected resources (Camera, Microphone, Full Disk Access) originating from Electron binaries invoked with unusual argument vectors.
Log keychain access requests from Electron apps and correlate against expected user-driven activity.

How to Mitigate CVE-2026-70597

Immediate Actions Required

Upgrade Electron to 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3 or later.
Rebuild and redistribute all downstream applications that bundle Electron with the patched runtime.
Audit installed macOS applications for outdated Electron versions using tools such as electron-version or Info.plist inspection.

Patch Information

The fix is committed in Electron commit 0a6291a, which replaces PID-based parent identification with audit tokens in shell/app/node_main.cc and shell/common/mac/codesign_util.cc. Full advisory details are in GitHub Security Advisory GHSA-jm7p-cc5g-qwxx.

Workarounds

Where upgrading is not immediately possible, disable the Electron fuses that permit ELECTRON_RUN_AS_NODE and NODE_OPTIONS if the application does not require them.
Restrict local user execution privileges on shared macOS systems to reduce the pool of potential attackers.
Apply macOS system integrity controls and endpoint hardening to limit process manipulation primitives available to local users.

bash

# Verify installed Electron version inside a macOS .app bundle
/Applications/YourApp.app/Contents/Frameworks/Electron\ Framework.framework/Versions/A/Resources/version

# Example: check bundled Electron version via Info.plist inspection
plutil -p "/Applications/YourApp.app/Contents/Info.plist" | grep -i electron