Electron: Local race condition in Squirrel.Mac update installation on macOS (CVE-2026-102672)
A local race condition vulnerability exists in the Squirrel.Mac auto-update framework bundled with Electron on macOS. The privileged ShipIt helper, which runs as root to complete updates, can be tricked by a local attacker to overwrite files of a different application instead of the intended one. This affects only Electron apps on macOS that use Squirrel.Mac-based auto-updates. No workarounds exist other than updating to a patched Electron version.
AI Analysis
Technical Summary
Electron's Squirrel.Mac auto-update framework on macOS includes a privileged helper called ShipIt that performs the final update step as root. A local race condition vulnerability (CVE-2026-102672) allows a local attacker to cause ShipIt to overwrite files belonging to a different application, potentially leading to privilege escalation or system compromise. This issue only affects Electron apps using Squirrel.Mac auto-updates on macOS. The vulnerability has a CVSS 3.1 score of 6.7 (medium severity) and requires local access with low privileges and user interaction. Fixed versions are 39.8.10, 41.10.5, and 42.0.0-beta.2.
Potential Impact
A local attacker with access to the macOS machine can exploit this race condition to overwrite arbitrary application files as root, potentially leading to unauthorized code execution or system compromise. The impact includes confidentiality, integrity, and availability violations. Only Electron apps using Squirrel.Mac auto-updates on macOS are affected. Apps on other platforms or those not using Squirrel.Mac are not impacted.
Mitigation Recommendations
Update Electron to one of the patched versions: 39.8.10, 41.10.5, or 42.0.0-beta.2. There are no application-side workarounds; remediation requires upgrading Electron to a fixed version.
Electron: Local race condition in Squirrel.Mac update installation on macOS (CVE-2026-102672)
Description
A local race condition vulnerability exists in the Squirrel.Mac auto-update framework bundled with Electron on macOS. The privileged ShipIt helper, which runs as root to complete updates, can be tricked by a local attacker to overwrite files of a different application instead of the intended one. This affects only Electron apps on macOS that use Squirrel.Mac-based auto-updates. No workarounds exist other than updating to a patched Electron version.
CVSS v3.1
Score 6.7medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Electron's Squirrel.Mac auto-update framework on macOS includes a privileged helper called ShipIt that performs the final update step as root. A local race condition vulnerability (CVE-2026-102672) allows a local attacker to cause ShipIt to overwrite files belonging to a different application, potentially leading to privilege escalation or system compromise. This issue only affects Electron apps using Squirrel.Mac auto-updates on macOS. The vulnerability has a CVSS 3.1 score of 6.7 (medium severity) and requires local access with low privileges and user interaction. Fixed versions are 39.8.10, 41.10.5, and 42.0.0-beta.2.
Potential Impact
A local attacker with access to the macOS machine can exploit this race condition to overwrite arbitrary application files as root, potentially leading to unauthorized code execution or system compromise. The impact includes confidentiality, integrity, and availability violations. Only Electron apps using Squirrel.Mac auto-updates on macOS are affected. Apps on other platforms or those not using Squirrel.Mac are not impacted.
Mitigation Recommendations
Update Electron to one of the patched versions: 39.8.10, 41.10.5, or 42.0.0-beta.2. There are no application-side workarounds; remediation requires upgrading Electron to a fixed version.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vv43-5jgx-7qv8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-102672"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6abc27cf680226ef6846f91b
Added to database: 09/29/2026, 21:04:15 UTC
Last enriched: 09/29/2026, 21:22:09 UTC
Last updated: 09/30/2026, 03:19:42 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.