Other nomination

Modern Alchemy: Turning XSS into RCE

Luca Carettoni

Electron's nodeIntegration flag should keep untrusted pages away from Node, but window.open returns a proxy object that bypasses the same-origin policy, and evaluating script inside the privileged chrome-devtools window restores require. Any cross-site scripting in an Electron app therefore becomes code execution on the desktop.

Record

Researcher

Luca Carettoni

In the archive

• Nominated for the 2016–17 Top 10 Web Hacking Techniques

Tags

• sandbox-escape
• rce
• sop-bypass
• xss
• electron
• nodejs
• same-origin-policy
• cve
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Luca Carettoni, first published at the original source. Preserved copies are kept so the citation survives its host.