{"id":"EUVD-2026-53403","revision":"d297606293524698aaa5e3c3a110dea0","records":[{"revision":"d297606293524698aaa5e3c3a110dea0","observedAt":"2026-11-09T15:06:35.012+00:00","statement":{"source":"euvd","id":"EUVD-2026-53403","aliases":["CVE-2026-70597","GHSA-jm7p-cc5g-qwxx"],"title":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent …","description":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access. This issue is fixed in 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.3,"severity":null}],"references":["https://github.com/electron/electron/security/advisories/GHSA-jm7p-cc5g-qwxx","https://github.com/electron/electron/commit/0a6291a97d210db3733689e70a51f5711e38ed35"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53403","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 5, 2026, 3:21:11 PM","dateUpdated":"Aug 6, 2026, 3:55:28 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-53403","identifiers":["EUVD-2026-53403","CVE-2026-70597","GHSA-jm7p-cc5g-qwxx"]},"retained":false,"historicalAffected":[]}],"coverage":[]}