Electron implements a macOS security check that verifies a launched application is started by a parent process of the same code signature. Prior to versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0‑beta.3, this check could be bypassed by a local process. By spoofing the parent signature, a local attacker can cause a signed Electron application to execute code with the application's entitlements, gaining file‑system access, keychain secrets, and other macOS protection‑domain privileges. The vulnerability is a CWE‑367: Inadequate Verification of Process Credentials. The impact is confined to local attackers who can run code inside the signed app without additional user interaction.

All macOS Electron applications built with Electron versions earlier than 39.8.8, 40.9.0, 41.2.1, or 42.0.0‑beta.3 are affected. The issue arises only on macOS, where the same‑signed parent check is enforced by Electron's runtime.

The CVSS score of 6.3 indicates moderate severity, reflecting that exploitation requires local access and knowledge of the target’s Electron runtime. EPSS is not available, suggesting the general exploit probability is not quantified, and the vulnerability is not listed in CISA KEV. The attack vector is local; a local attacker must have the ability to run code on the target machine, which may be feasible in environments with compromised credentials or physical access. If an attacker can run an arbitrary local process, they can bypass the signature check, launch the target application, and execute code within its privilege context.