Electron - Build cross platform desktop XSS, it’s easier than you think
summary
Electron apps let a single DOM XSS turn into full arbitrary code execution because Chromium plus Node gives renderers OS access; demo shows an injected image onerror or script can spawn child_process.exec or read local files and exfiltrate them, even launch calc. CSP often fails (meta-refresh and file:// origins), webview and iframe rules add surprising attack paths. Concrete fixes: one DOM XSS -> arbitrary code execution, disable nodeIntegration, use iframe sandbox, preload to expose limited APIs and validate/block file: URLs and popups.
AI-written summary · about
chapters (10)
- 0:00Cross-platform Electron development
- 2:55Electron app structure and startup
- 5:29Electron security importance
- 12:49XSS basics
- 18:04XSS impact in Electron
- 24:23Content Security Policy limits
- 26:31Disabling Node.js features
- 30:44Safe preload implementation
- 33:33Third-party ad risks
- 37:48Electron security summary
related talks
48mPreloading Insecurity In Your Electron
34m"The magic of XSS - not only in web applications"
01h 02meXential XSS (Cross Site Scripting)
23mJavaScript attack surface
27mBuilding Cross Platform Desktop Apps With Electron
42mEverything you need to know about client-side malicious code execution
34mJS Security - A Pentesters Perspective
27mPwning Electron Application : Analysis and Defense of Vulnerabilities in Electron Applications