CVE-2026-102672: 
JavaScript vulnerability analysis and mitigation

CVE-2026-102672 is a local privilege escalation vulnerability in Electron's bundled Squirrel.Mac auto-update framework on macOS, classified as a Time-of-check Time-of-use (TOCTOU) race condition. The vulnerability was originally reported by researcher "sgretas" and first published to the GitHub Advisory Database on August 29, 2026, with the advisory updated on September 29, 2026. It affects Electron npm package versions prior to 39.8.10, versions 40.0.0-alpha.1 through 41.10.5, and versions 42.0.0-alpha.1 through 42.0.0-beta.2. Only macOS applications shipping Squirrel.Mac-based auto-updates are affected; other platforms are not impacted. The CVSS v3.1 base score is 6.7 (Medium) (GitHub Advisory).

The root cause is a TOCTOU race condition (CWE-367) in Squirrel.Mac's privileged ShipIt helper process, which performs the final step of an application update running as root. The target bundle URL was read from a serialized request stored on disk and re-evaluated at multiple points in the install signal chain (-[SQRLInstaller installRequest:]), rather than being resolved once to a canonical path at the start. A local attacker with low privileges could exploit the window between path validation and use — for example, by substituting a symbolic link pointing to a different application's bundle directory — causing the root-privileged ShipIt helper to overwrite arbitrary application files. The fix resolves the target bundle URL to a canonical path exactly once at the top of the install chain, rejects non-canonical paths, and additionally requires that when running as root, the target must be the application bundle containing the installer itself (GitHub Advisory, Electron Commit b8f25c4).

Successful exploitation allows a local attacker to cause the root-privileged ShipIt helper to overwrite files belonging to a different application on the system, effectively enabling arbitrary file write as root. This can lead to high confidentiality, integrity, and availability impacts — an attacker could replace critical application binaries or configuration files, potentially achieving persistent code execution with elevated privileges or rendering targeted applications inoperable. The scope is limited to macOS systems running Electron applications that use Squirrel.Mac auto-updates, and exploitation requires both local access and user interaction (e.g., triggering an update) (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-102672 as of the available data. The vulnerability requires local access to the target machine, low privileges, and user interaction (triggering an update), which significantly limits its attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Advisory).

1. Gain local access: Obtain a low-privileged local user account on a macOS system running a vulnerable Electron application (< v39.8.10, or v40.x–v41.x < 41.10.5, or v42.x < 42.0.0-beta.2) that uses Squirrel.Mac auto-updates.
2. Identify the ShipIt state file: Locate the serialized SQRLShipItRequest file written to disk by SQRLUpdater when an update is prepared. This file contains the targetBundleURL path that the privileged ShipIt helper will use.
3. Trigger an update: Cause the vulnerable Electron application to initiate an auto-update, which writes the install request to disk and prepares to invoke the privileged ShipIt helper.
4. Race the path resolution: In the window between when the request is written and when ShipIt reads and acts on it, replace the target bundle path (or an ancestor directory component) with a symbolic link pointing to a different application's bundle directory (e.g., /Applications/TargetApp.app).
5. Achieve privileged file overwrite: When ShipIt runs as root and re-resolves the target path, it follows the attacker-controlled symlink and overwrites the files of the unintended application with the update bundle contents, achieving arbitrary file write as root (GitHub Advisory, Electron Commit b8f25c4).

• File System: Unexpected symbolic links appearing in or near Electron application bundle directories (e.g., /Applications/*.app) around the time of an auto-update; unexpected modification timestamps on files within non-Electron application bundles following an Electron app update.
• Logs: macOS system logs or Electron application logs showing ShipIt helper activity targeting an unexpected application path; log entries containing "Privileged install rejected: target ... does not match installer bundle ..." (on patched versions, indicating an attempted exploit).
• Process: The ShipIt helper process (running as root) observed writing to directories outside the expected Electron application bundle; unusual ShipIt invocations not correlated with a legitimate update event for the associated application.

The Electron team has released patched versions that resolve the target bundle URL to a canonical path once at the start of the install chain and enforce that privileged installs only target the application bundle containing the installer. Affected users should upgrade to one of the following fixed versions: 39.8.10, 41.10.5, or 42.0.0-beta.2. There are no application-side workarounds available — updating to a patched version of Electron is the only remediation (GitHub Advisory, Electron v39.8.10 Release, Electron v41.10.5 Release).