CVE-2026-70597: Electron: Parent process code-sign check is spoofable
Impact On macOS, the check Electron uses to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable the fuse-based hardening restricting ELECTRONRUNASNODE and NODEOPTIONS to same-signed parents rely on this check; a local attacker could bypass it and run their own code inside the signed app, inheriting its TCC permissions and keychain access.
Apps are only affected if they enable those macOS fuse-based restrictions. Apps that do not enable them are not affected.
Workarounds There are no app side workarounds, you must update to a patched version of Electron.
Fixed Versions 42.0.0-beta.3 41.2.1 40.9.0 39.8.8
For more information If you have any questions or comments about this advisory, email us at security@electronjs.org
Other sources
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRONRUNASNODE and NODEOPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 40.9.1 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade
electronto a version that resolves this vulnerability.Fixed in 39.8.8 - Upgrade
Upgrade
electronto a version that resolves this vulnerability.Fixed in 40.9.0 - Upgrade
Upgrade
electronto a version that resolves this vulnerability.Fixed in 41.2.1 - Upgrade
Upgrade
electronto a version that resolves this vulnerability.Fixed in 42.0.0-beta.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70597?
The severity of CVE-2026-70597 is medium with a score of 6.3.
How do I fix CVE-2026-70597?
To fix CVE-2026-70597, upgrade to Electron versions 39.8.8, 40.9.0, 41.2.1, or 42.0.0-beta.3.
What is the risk associated with CVE-2026-70597?
The risk associated with CVE-2026-70597 is rated at 47.
What type of applications are affected by CVE-2026-70597?
CVE-2026-70597 affects desktop applications built using the Electron framework.
What kind of threat does CVE-2026-70597 pose?
CVE-2026-70597 poses a threat of code-signing spoofing on macOS.