ElectroVolt: Pwning Popular Desktop Apps via Electron Framework Flaws
Aaditya Purani and Max Garrett expose systemic Electron framework misconfigurations, turning standard web XSS into remote code execution across popular desktop apps.
Summary
The Ubiquity of Electron Desktop Applications
Leading enterprise collaboration, developer tools, and consumer messaging apps rely on Electron to package Chromium and Node.js into standalone cross-platform software.
Analyzing Node Integration and Context Isolation
Aaditya Purani and Max Garrett dissect recurring developer misconfigurations—including disabled context isolation, insecure preload scripts, and custom IPC handlers.
Weaponizing Remote Content for Code Execution
The authors demonstrate chaining cross-site scripting (XSS) in loaded web views to execute arbitrary system shell commands on macOS and Windows hosts.
Hardening Guidelines for Electron Developers
The presentation provides a comprehensive security checklist—enforcing strict Content Security Policies (CSP), secure IPC design, and context bridge validation.
Related talks
Main Stage·34 min
Eugene Lim
Eugene Lim (spac3sc) explores vulnerabilities in the ubiquitous iCalendar (.ics) standard, demonstrating zero-click XSS, RCE, and credential theft via calendar invites.
Main Stage·38 min
Junyu Zhou
Demonstrates how web security vulnerabilities (XSS, SSRF, path traversal) in Electron desktop applications escalate to full OS code execution.
Main Stage·40 min
Bohan Liu · Zheng Wang · GuanCheng Li
Demonstrates transforming publicly patched Chromium N-day vulnerabilities into remote code execution 0-days across popular Electron and CEF desktop applications.