CVE-2026-102672

Executive Summary

CVE-2026-102672 is a local privilege-escalation and TOCTOU (time-of-check-to-time-of-use) vulnerability (CWE-367) in the macOS ShipIt helper used by Electron's Squirrel.Mac-based automatic update mechanism. In affected versions, the privileged helper does not bind the validated update target to a single canonical application-bundle path for the entire installation, allowing a local attacker to redirect a root-level file write to overwrite another application's files instead of the application that initiated the update. Only macOS applications built on Electron that use Squirrel.Mac-based auto-updates are affected; applications on other platforms, and macOS applications not using Squirrel.Mac updates, are not impacted.

Technical Analysis

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. On macOS, Electron applications that rely on Squirrel.Mac for automatic updates delegate the privileged installation of downloaded update payloads to a helper process named ShipIt, which runs with elevated (root) privileges to place files into application bundle locations that ordinary users cannot write to.

The vulnerability class is a time-of-check-to-time-of-use race condition (CWE-367). Per the NVD description, the ShipIt helper "did not bind the validated update target to one canonical application-bundle path for the full installation." In practical terms, the helper validates an update target at one point, but the destination path it subsequently writes to is not held fixed (canonical) across the whole installation operation. A local attacker able to race or otherwise influence the resolved path between validation and write can cause the root-level write to land in a different application bundle — allowing the update installation to overwrite another application's files rather than the application that initiated the update.

The attack surface is local to the macOS host. The relevant trust boundary is between a normal local user (or a low-privileged process on the same machine) and the root-owned ShipIt installation routine. Because the helper performs writes with elevated privileges, a successful redirection produces a privileged file overwrite of an arbitrary (attacker-selected) application bundle. The description characterizes this specifically as overwriting another application's files — it does not claim arbitrary code execution at the kernel level, and no specific file paths, function names, or API parameters beyond the "ShipIt" helper and "Squirrel.Mac" update framework are provided in the source data.

The CVSS v3.1 vector reflects the local, race-dependent nature of the flaw: AV:L (local), AC:H (high complexity, consistent with a race window), PR:L (low privileges required), UI:R (user interaction required — an update must be in progress), with High confidentiality, integrity, and availability impacts (C:H/I:H/A:H).

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-102672. The attack chain below is described at the vulnerability-class level and is inferred strictly from the NVD description; it does not rely on any fabricated function names, endpoints, or file paths.

1. Reconnaissance / target identification. The attacker has local access to a macOS host (or local code execution in a low-privileged context). They identify an installed Electron-based application that uses Squirrel.Mac-based automatic updates and observe or wait for an update operation to be initiated. The presence of the ShipIt helper and the Squirrel.Mac update flow is the precondition for exploitation.

2. Triggering the flaw. The core weakness is that the privileged helper does not bind the validated update target to one canonical application-bundle path for the full installation. The attacker must act within the race window during an in-progress update — i.e., between the point where ShipIt validates the update target and the point where it performs the root-level write. By influencing or racing the resolution of the target path during that window, the attacker can cause the helper to write to a different application bundle than the one that initiated the update. This is a classic TOCTOU redirection.

3. Payload / execution method (class level). Because the helper writes with root privileges, the redirection turns the update write into a privileged overwrite of another application's files. The precise artifact written is the update payload itself; the attacker's leverage is over where it lands, not over arbitrary code they author at root. Execution impact therefore manifests wherever the redirected (overwritten) application bundle is subsequently loaded or executed by a user or the system.

4. Post-exploitation impact. Per CVSS, a successful overwrite yields High integrity, confidentiality, and availability impact. Integrity: application files belonging to an unrelated application are replaced with attacker-influenced content. Availability: overwriting another application's files can render that application non-functional or corrupt. Confidentiality: an attacker positioned to overwrite files in another bundle may be able to place content that the victim application later reads or executes under the victim's context. The user-interaction requirement (UI:R) and high attack complexity (AC:H) make exploitation timing-dependent.

Impact Assessment

The vulnerability provides a local attacker with the ability to leverage a root-privileged update helper to overwrite files inside an application bundle other than the one that initiated the update. This crosses a privilege boundary: a low-privileged local actor causes root-owned writes to an attacker-affected location.

• Confidentiality (C:H): The ability to place contents into another application's bundle can expose the victim application's data to manipulation or later disclosure depending on how the targeted application consumes files.
• Integrity (I:H): Directly core to the flaw — application files are replaced/overwritten with content that does not originate from a legitimate update for that application.
• Availability (A:H): Overwriting another application's bundle files can corrupt or break that application.

Blast radius: Scoped to macOS endpoints running Electron applications that use Squirrel.Mac-based automatic updates, and only during an update operation. Per the advisory, applications on other platforms and macOS applications that do not use Squirrel.Mac auto-updates are not affected. Enterprise impact is concentrated on managed macOS fleets running affected Electron desktop apps; because exploitation requires local access and a race during update, the realistic threat is a local user escalating impact against other installed applications on the same host.

CISA KEV status: No — this CVE is not known to be exploited in the wild. EPSS: not yet scored by FIRST.org (no value should be assumed). No public PoC.

Detection Guidance

Detection for this issue is primarily host-based, because the trigger is a local race in a privileged macOS helper rather than a network-facing service. Network detections below target update-download and helper-related telemetry where observable. The rules are written generically (no invented function names) and should be tuned to your environment.

Sigma Rule

title: Suspicious macOS Electron ShipIt Helper Update Activity (CVE-2026-102672)
id: 3c9f1a72-1026-7267-cve1-102672000001
status: experimental
description: Detects anomalous invocation of the macOS ShipIt privileged update helper associated with Squirrel.Mac auto-updates, indicative of potential TOCTOU target redirection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102672
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: macos
detection:
  selection_helper:
    Image|endswith: '/ShipIt'
  selection_parent:
    ParentImage|contains:
      - '.app/Contents/'
  condition: selection_helper and selection_parent
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
falsepositives:
  - Legitimate Electron application auto-updates via Squirrel.Mac
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.102672

YARA Rule

rule CVE_2026_102672_Electron_ShipIt
{
    meta:
        description = "Detection aid for Electron macOS ShipIt update helper related artifacts (CVE-2026-102672)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102672"
        cve = "CVE-2026-102672"

    strings:
        $s1 = "ShipIt" ascii
        $s2 = "Squirrel.Mac" ascii
        $s3 = "Squirrel" ascii
        $s4 = "ShipItState" ascii

    condition:
        uint32(0) == 0xfeedface or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe
        and any of ($s*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-102672 Possible Electron/Squirrel.Mac Update Fetch on macOS Host"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Squirrel"; nocase; http.header; content:"Mac"; nocase; reference:cve,2026-102672; classtype:attempted-user; sid:1026720001; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "ShipIt" and process.parent.name != null

Splunk SPL Query

index=os sourcetype=macos_process
| search (process_name="ShipIt" OR process="ShipIt" OR Image="*ShipIt")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, parent_process_name, process_path
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="macos,electron,cve_2026_102672,">
  <rule id="102672" level="8">
    <decoded_as>json</decoded_as>
    <field name="process.name">ShipIt</field>
    <description>CVE-2026-102672: macOS ShipIt privileged update helper executed - possible Electron Squirrel.Mac TOCTOU target redirection</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A fix is asserted by a single source (GHSA); it is not independently confirmed by a second advisory source in the provided data. Treat as a claimed fix and verify before relying on it.

1. Immediate mitigations.

   • Restrict which applications are permitted to run auto-update mechanisms requiring privileged helpers, and limit local interactive access to macOS endpoints where feasible (exploitation requires local access and an in-progress update with user interaction).
   • If an application cannot be updated immediately, consider temporarily disabling Squirrel.Mac-based automatic updates for that application (manual/controlled update workflows reduce the window in which the race can be triggered).
   • Monitor for anomalous ShipIt helper execution and unexpected modification of application bundles on macOS hosts (see Detection Guidance).

2. Patch / upgrade steps.

   • Upgrade affected Electron-based applications so they ship with Electron 39.8.10, 41.10.5, or 42.0.0-beta.2 (or later), per the advisory.
   • Because this is a framework-level fix, the practical action for application owners is to rebuild/re-release their Electron app with a patched Electron version, and for end users to install the updated application build.
   • Validate that the update helper and the application bundle are replaced as part of the vendor patch; confirm the applied version against the advisory.

3. Long-term hardening.

   • Enforce a policy requiring Electron desktop applications to track upstream support branches and update promptly, given the recurring nature of auto-update helper privilege issues.
   • Apply the principle of least privilege to any helper that performs elevated file operations, and prefer designs that bind validated targets to a single canonical path across the whole install operation.
   • Maintain host-based detection coverage for privileged helper invocation and application bundle integrity monitoring on macOS fleets.

References

• NVD — CVE-2026-102672: https://nvd.nist.gov/vuln/detail/CVE-2026-102672
• GitHub Security Advisory (GHSA) — source of the claimed patch (Electron 39.8.10, 41.10.5, 42.0.0-beta.2)
• Electron — project documentation / releases: https://github.com/electron/electron/releases
• Squirrel.Mac — macOS auto-update framework used by Electron: https://github.com/Squirrel/Squirrel.Mac
• CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: https://cwe.mitre.org/data/definitions/367.html

Threat actor campaigns / exploit-in-the-wild: None known. CISA KEV: No. No public PoC or exploit code is available for CVE-2026-102672.