# Desktop

## Scope and learning route

Desktop scope must identify the product, platform, architecture, installer/package format, release channel, version, and publisher identity. Include separate entries for installers, updaters, background services, privileged helpers, plugins, browser extensions, native-messaging hosts, and local APIs. For extensions, record store listing, extension ID, version, browser build, Manifest version, and whether the tested copy is store-installed or unpacked. Explicitly distinguish a user application, system service, browser extension, and operating-system vulnerability.

An OSS clone supports local source review; it does not establish authorization for the vendor’s update infrastructure. An installer available for download does not automatically make all distribution hosts or dependencies bounty-eligible. Record whether local privilege escalation, user-assisted file attacks, denial of service, enterprise-only deployment, beta releases, and unsupported versions qualify before committing time.

Recommended progression: installer/package inspection → process and privilege mapping → local IPC and protocol handlers → update verification → Electron/extension bridges → native parser fuzzing. The useful skill is explaining precisely which lower-trust principal gains a higher-trust capability.

## Lab and evidence model

Use disposable Windows and Linux VMs and an owned Mac or supported macOS virtualization environment. Snapshot before installation; use a standard user for attacker modeling and a separate administrative account only for setup. Keep shared folders and personal credentials out of the experiment. Instrument only the target’s processes and synthetic files where practical.

Create a boundary ledger: entry point, attacker control, consumer identity, validation, protected capability, observation, and negative control. Local administrator modification of an application is not evidence of privilege escalation. A missing DLL in a trace, broad file permission, or unsigned resource becomes significant only when a lower-privileged actor can influence a path actually trusted by a more privileged consumer. Windows Process Monitor records file, registry, and process activity useful for establishing that chain. [Microsoft Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon).

## Native desktop playbook

1. **Inventory installation and updates.** Compare package contents, install destination, post-install actions, services/helpers, scheduled tasks, and registration of custom schemes/file types. Observe a normal install/update in the snapshot. **Gate:** retain exact installer hash, version, signer, and default configuration.
2. **Map local authority.** On Windows, review service configuration, named-pipe access, registry and filesystem ACLs. On macOS, inspect launch agents/daemons, XPC services, entitlements, helper identity validation, and container boundaries. On Linux, examine service users, Unix sockets, D-Bus/polkit interfaces, package scripts, capabilities, file ownership, and writable search paths. **Gate:** identify a real lower-trust caller or writable object used by the target, rather than assuming every local IPC endpoint is unprotected.
3. **Trace file and command inputs.** Review document import, archive extraction, plugin loading, URL handlers, temporary files, argument construction, and working-directory assumptions. Use unique harmless markers in a dedicated test directory. **Gate:** show the unintended operation and effective identity; do not infer command execution from a parsing error.
4. **Verify the update trust chain.** Determine whether metadata, downloaded bytes, publisher identity, and applicable version/rollback policy are verified before installation or execution. Model tampered artifacts only in a local updater harness or explicitly supported test feed. **Gate:** a production-equivalent decision accepts an unauthorized artifact or violates the intended version policy. A valid outer installer signature does not prove all subsequent update decisions are correct. Apple’s archived code-signing note supports signature inspection, but modern runtime/notarization behavior must be verified on the actual supported OS. [Apple TN2206](https://developer.apple.com/library/archive/technotes/tn2206/_index.html).
5. **Fuzz exposed native parsers.** Select a reachable file/protocol parser, isolate it behind a deterministic harness, seed representative valid inputs, and measure coverage. Use an instrumented local build and suitable sanitizers; bound CPU, memory, disk, and runtime. **Gate:** minimize and reproduce the crash, identify root cause, and explain how an attacker delivers the input to a supported release. A crash alone does not prove code execution or bounty eligibility. [AFL++ fuzzing guide](https://aflplus.plus/docs/fuzzing_in_depth/).
6. **Retest with realistic privileges.** Restore the clean snapshot and reproduce the smallest effect without debugger-granted access or administrative preconfiguration that the attack would not possess. Include user interaction, restart requirements, and deployment differences in the report.

## Electron and browser-extension playbook

For **Electron**, map remote/local content → renderer → preload/context bridge → main-process IPC → filesystem, shell, credentials, or privileged helper. Inspect window-specific settings rather than assuming defaults apply everywhere. Trace navigation, child windows, custom protocols, `shell.openExternal`, and permission decisions. Validate IPC sender frame/origin and arguments; `contextIsolation: true` does not repair a bridge exposing arbitrary privileged methods. **Gate:** demonstrate an attacker-controlled input reaching a protected operation through the shipped bridge, rather than executing code manually in developer tools. [Electron security](https://www.electronjs.org/docs/latest/tutorial/security), [Context Isolation](https://www.electronjs.org/docs/latest/tutorial/context-isolation).

For **extensions**, map page → content script → service worker/extension page → privileged browser API. Inspect host permissions, optional permissions, `externally_connectable`, web-accessible resources, CSP, and message handlers. Check sender identity, origin/frame association, action allowlists, and argument constraints across asynchronous navigation. Broad permissions increase the potential impact but do not themselves demonstrate abuse. **Gate:** a controlled web page or authorized test extension causes an unintended privileged action without first receiving privileges unavailable to a realistic attacker. [Chrome extension security](https://developer.chrome.com/docs/extensions/develop/security-privacy/stay-secure), [Message passing](https://developer.chrome.com/docs/extensions/develop/concepts/messaging).

If a native-messaging host exists, extend the analysis into its manifest, allowed extension origins, executable location, framing/parser, and command handling. The native host runs outside the browser process; extension-side validation is only one part of the chain. **Gate:** preserve the complete web-to-extension-to-native sequence and its actual privileges, or report only the narrower verified boundary. [Chrome native messaging](https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging).

## Desktop hypotheses

| Hypothesis | Local validation | Evidence gate |
|---|---|---|
| A privileged service trusts a writable file | Trace one normal operation and inspect its ACL | Standard-user control, consumer identity, meaningful effect |
| Update verification covers the wrong object | Exercise a local fixture through equivalent verification code | Accepted bytes, expected signer/policy, acceptance point |
| URL/file handler misinterprets input | Use a synthetic URI/document with a harmless marker | Entry path, argument interpretation, resulting operation |
| Electron IPC trusts an untrusted frame | Trace a controlled frame through a shipped bridge | Sender origin, method reachability, protected capability |
| Extension forwards arbitrary privileged requests | Exercise a local page through its normal content script | Real sender, requested action, cross-boundary result |
| Native parser has a memory-safety defect | Minimize a local sanitizer-triggering input | Reproducible fault, root cause, supported attack path |

## Desktop checklist

**Native applications: apply each item to Windows, macOS, or Linux as relevant.**

- [ ] Product, platform, architecture, channel, version, hash, signer recorded.
- [ ] Installer, updater, service/helper, and plugin scope separated.
- [ ] Clean snapshot and standard-user baseline captured.
- [ ] Default installation paths and post-install actions mapped.
- [ ] Service/helper effective identity documented.
- [ ] IPC caller authentication and object-level authorization reviewed.
- [ ] Writable executable, configuration, temporary, and search paths checked.
- [ ] Windows registry/filesystem ACLs and named-pipe access inspected.
- [ ] macOS XPC, launch services, entitlements, and signing checks inspected.
- [ ] Linux sockets, D-Bus/polkit, service users, capabilities, and ownership inspected.
- [ ] Protocol handlers, file associations, imports, and archive boundaries exercised.
- [ ] Update metadata, artifact, signer, and rollback policy traced.
- [ ] Parser fuzzing limited to a local harness with resource limits.
- [ ] Crashes minimized; impact distinguished from code-execution speculation.
- [ ] Reproduction repeated without artificial administrator privileges.

**Electron and extensions**

- [ ] Shipped Electron/browser version and extension ID/version captured.
- [ ] Store-installed and modified/unpacked evidence distinguished.
- [ ] Every renderer/window’s security settings inspected.
- [ ] Context isolation and sandbox assumptions verified.
- [ ] Preload methods and main-process IPC handlers inventoried.
- [ ] IPC sender frame/origin and argument checks inspected.
- [ ] Navigation, child-window, and external-protocol handling reviewed.
- [ ] Host/API/optional permissions and intended usage mapped.
- [ ] External messaging and web-accessible resources restricted appropriately.
- [ ] Page-origin data treated as untrusted through content-script messages.
- [ ] Privileged service-worker actions require bounded inputs.
- [ ] Native-messaging host origin list, path, and parser reviewed.
- [ ] Local browser profile contains only synthetic application data.
- [ ] Result reproduced through a realistic entry point, without console-only access.

## Desktop command cheat sheet

These are local inspection examples. Paths refer to lab copies. A successful signature check establishes signature validity under the tool’s rules, not absence of vulnerabilities. PowerShell Authenticode inspection is Windows-specific; Apple commands require macOS. [Microsoft Authenticode](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature?view=powershell-7.5), [icacls](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls), [Apple signature verification](https://developer.apple.com/library/archive/technotes/tn2206/_index.html), [GNU readelf](https://sourceware.org/binutils/docs/binutils/readelf.html).

```powershell
# Windows / PowerShell: inspection only.
Get-AuthenticodeSignature -FilePath 'C:\Lab\App.exe' | Format-List
icacls 'C:\Lab\App.exe'
icacls 'C:\Program Files\ExampleApp'
```

```bash
# macOS: inspect a lab copy; do not re-sign it for the baseline.
plutil -p ./Example.app/Contents/Info.plist
codesign -dv --verbose=4 ./Example.app
codesign -d --entitlements :- ./Example.app
codesign --verify --deep --strict --verbose=2 ./Example.app

# Linux or another host with GNU binutils: read ELF metadata without execution.
readelf -hW ./lab-app
readelf -lW ./lab-app
readelf -dW ./lab-app

# Search local source/extracted JavaScript; matches are investigation leads.
rg -n 'ipcMain|contextBridge|nodeIntegration|contextIsolation|openExternal' ./source
rg -n 'onMessage|externally_connectable|host_permissions|nativeMessaging' ./extension
```

For an already prepared AFL++ lab, first inspect `afl-fuzz -h`. A campaign skeleton is `afl-fuzz -i ./seeds -o ./fuzz-results -- ./parser-harness @@`; `@@` supplies the current input filename. It runs until stopped unless bounded by supported runtime options. Configure limits before starting, and interrupt with Ctrl-C. The harness must avoid network calls, production credentials, and side effects outside the disposable lab. [AFL++ execution and resource guidance](https://aflplus.plus/docs/fuzzing_in_depth/).

## Extension cases to complete before closing the review

The [extension message procedure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/extension-message-boundaries.html) adds a full case matrix for page forwarding, browser-supplied identity, changed document after navigation, worker restart and optional permission revocation. Run it before [native IPC](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/desktop-ipc.html) if the product contains an extension. Chrome's message metadata and service-worker lifetime are separate concerns; preserve both in the evidence. [MessageSender](https://developer.chrome.com/docs/extensions/reference/api/runtime#type-MessageSender), [worker lifecycle](https://developer.chrome.com/docs/extensions/develop/concepts/service-workers/lifecycle).

| Boundary | Positive control | Negative control |
|---|---|---|
| Page to extension | Intended action from allowed page | Same action from second controlled origin |
| Delayed response | Original document remains | Tab navigates before result delivery |
| Worker lifetime | Authorized operation before stop | Denied operation remains denied after restart |
| Optional permission | User grants required capability | Capability revoked through browser controls |

Backend sign-in shared with mobile/web belongs in [federation/token trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/federation-token-trust.html) and [authenticator lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authenticator-lifecycle.html). Preserve the native callback or extension route in the reproduction instead of reporting only a generic server test.

## Sources


All sources accessed **2026-09-11**. “Undated” means no reliable publication/update date was established from the retrieved page. Dates are page metadata, not a guarantee of completeness for every current OS version. Archived Apple sources are used for established mechanisms and command syntax, not blanket claims about current platform enforcement.

| ID | Publisher / exact source | Date | Use |
|---|---|---|---|
| MD01 | OWASP, [OWASP MASVS](https://mas.owasp.org/MASVS/) | Undated; living standard | Mobile control organization |
| MD02 | OWASP, [OWASP MASTG](https://mas.owasp.org/MASTG/) | Undated; living guide | Testing methodology and technique catalog |
| MD03 | OWASP, [Mobile Application Security Weakness Enumeration](https://mas.owasp.org/MASWE/) | Undated; living catalog | Weakness taxonomy and version caution |
| MD04 | Google, [Android Debug Bridge](https://developer.android.com/tools/adb) | Updated 2026-09-02 | Device/package inspection commands |
| MD05 | Google, [apkanalyzer](https://developer.android.com/tools/apkanalyzer) | Updated 2026-03-05 | APK metadata and manifest CLI |
| MD06 | Google, [apksigner](https://developer.android.com/tools/apksigner) | Updated 2026-03-05 | APK certificate/signature inspection |
| MD07 | Google, [android:exported](https://developer.android.com/privacy-and-security/risks/android-exported) | 2024-09-24, indexed page date | Component exposure and version dependence |
| MD08 | Google, [Unsafe use of deep links](https://developer.android.com/privacy-and-security/risks/unsafe-use-of-deeplinks) | 2024-10-24, indexed page date | Deep-link validation |
| MD09 | Google, [WebView – Native bridges](https://developer.android.com/privacy-and-security/risks/insecure-webview-native-bridges) | Updated 2024-10-15 | Frames, native bridges, origin boundaries |
| MD10 | Google, [Network security configuration](https://developer.android.com/privacy-and-security/security-config) | Updated 2026-08-28 | Trust anchors and debug overrides |
| MD11 | Google, [Content provider basics](https://developer.android.com/guide/topics/providers/content-provider-basics) | Undated in this registry | Provider access model |
| MD12 | skylot/JADX maintainers, [JADX repository and CLI](https://github.com/skylot/jadx) | Undated; living README | Decompiler usage and limitations |
| MD13 | Apktool maintainers, [CLI Parameters](https://apktool.org/docs/cli-parameters/) | Undated | Local package decoding |
| MD14 | OWASP, [iOS Security Testing](https://mas.owasp.org/MASTG/0x06b-iOS-Security-Testing/) | Undated | iOS lab/platform distinctions |
| MD15 | Apple, [Keychain data protection](https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web) | Published 2024-12-19 | Access groups, classes, authentication constraints |
| MD16 | Apple, [Support Universal Links](https://developer.apple.com/library/archive/documentation/General/Conceptual/AppSearch/UniversalLinks.html) | Updated 2016-12-15; archived | App/website association model |
| MD17 | OWASP, [MASTG-TOOL-0062: Plutil](https://mas.owasp.org/MASTG/tools/ios/MASTG-TOOL-0062/) | Undated | Property-list inspection tooling |
| MD18 | OWASP, [MASTG-TECH-0111: Extracting Entitlements from MachO Binaries](https://mas.owasp.org/MASTG/techniques/ios/MASTG-TECH-0111/) | Undated | Signing/entitlement inspection |
| MD19 | Apple, [TN2206: macOS Code Signing In Depth](https://developer.apple.com/library/archive/technotes/tn2206/_index.html) | Page updated 2016-09-13; archived | Signature verification command and boundaries |
| MD20 | Microsoft / Mark Russinovich, [Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) | Published 2026-09-10 | Local process, registry, filesystem observation |
| MD21 | Microsoft, [Get-AuthenticodeSignature](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature?view=powershell-7.5) | Undated; PowerShell 7.5 documentation | Windows signature inspection |
| MD22 | Microsoft, [icacls](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/icacls) | Updated 2025-06-09 | Windows ACL inspection |
| MD23 | OpenJS Foundation / Electron contributors, [Security](https://www.electronjs.org/docs/latest/tutorial/security) | Undated; living documentation | Renderer, navigation, IPC boundaries |
| MD24 | Electron contributors, [Context Isolation](https://www.electronjs.org/docs/latest/tutorial/context-isolation) | Undated | Bridge limitations and API exposure |
| MD25 | Google, [Stay secure](https://developer.chrome.com/docs/extensions/develop/security-privacy/stay-secure) | Page states updated 2018-03-06 | Extension permissions and untrusted messages |
| MD26 | Google, [Message passing](https://developer.chrome.com/docs/extensions/develop/concepts/messaging) | Page states updated 2025-12-03 | Extension messaging contexts |
| MD27 | Google, [Native messaging](https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging) | Page states updated 2023-02-27 | Native host manifest and execution boundary |
| MD28 | AFL++ maintainers, [Fuzzing in Depth](https://aflplus.plus/docs/fuzzing_in_depth/) | Undated; living guide | Harness, corpus, execution, resource limits |
| MD29 | GNU Binutils / Sourceware, [readelf](https://sourceware.org/binutils/docs/binutils/readelf.html) | Undated | Non-executing ELF metadata inspection |


## Shared investigation procedures

- [Object, function, and property authorization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authz-matrix.html) — Turn identities, tenants, objects, roles, and lifecycle transitions into a reproducible permission matrix.
- [Authentication, recovery, federation, and session lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/identity-session.html) — Test registration, recovery, identity changes, invitations, SSO enforcement, and deprovisioning as one account state machine.
- [Trace input into queries, commands, and templates](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/injection-tracing.html) — Prove interpretation at a specific sink using small paired experiments instead of payload spraying.
- [Server-side fetching and network trust boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/ssrf-boundary.html) — Separate an intended fetch from a request that reaches a prohibited destination, forwards authority, or exposes a protected response.
- [Browser execution, cross-origin reads, and forged actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) — Use real browser behavior to distinguish XSS, CSRF, CORS, and messaging failures from header-only leads.
- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.
- [Workflow invariants, replay, idempotency, and races](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/state-business-logic.html) — Find security consequences in workflow ordering and concurrency, with serial controls and durable-state evidence.
- [REST, GraphQL, gRPC, WebSocket, and SSE permission parity](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/api-protocols.html) — Carry the same permission invariant across protocols, nested fields, streams, and alternate API versions.
- [OSS lab: pin, install, prove, reset](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/oss-lab-reproduction.html) — Turn an eligible release into a repeatable synthetic environment with preserved versions, realistic controls, and an explicit reset recipe.
- [Source review: entry point to protected operation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/source-dataflow.html) — Trace attacker control and authorization through handlers, services, queues, and sensitive operations; promote only reachable violations of a stated invariant.
- [CI and releases: trace untrusted input into privileged work](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/supply-chain-ci.html) — Audit workflow events, shell interpolation, untrusted builds, artifact consumers, and release identity as one privilege chain.
- [Dependencies: from advisory match to reachable impact](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/dependency-reachability.html) — Separate composition, advisory matching, runtime reachability, and exploit prerequisites so dependency reports describe product impact.
- [Libraries and parsers: bounded fuzzing to a minimal reproducer](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/parser-fuzzing.html) — Build a realistic local harness, instrument the target, bound fuzzing resources, and turn unique faults into defensible library or consumer reports.
- [Client storage, logs, backup and transport trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/client-storage-transport.html) — Measure where sensitive client state goes, who can retrieve it, and whether transport rejects invalid peers.
- [Desktop IPC, Electron bridges and native protocols](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/desktop-ipc.html) — Follow page, file and local-process inputs into privileged desktop capabilities with a realistic caller.
- [Update signatures, rollback and privileged installation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/update-integrity.html) — Test the update decision and installation boundary while preserving production signer and privilege assumptions.
- [MFA and passkeys: enrollment, proof, replacement, and recovery](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/authenticator-lifecycle.html) — Follow each authenticator from account binding to removal, and validate WebAuthn assertions without mistaking client UI or counter behavior for a security guarantee.
- [OAuth, OIDC, and SAML: transaction binding and token trust](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/federation-token-trust.html) — Separate browser transaction binding, issuer trust, token purpose, and identity linking using controlled federation fixtures.
- [Browser extensions: message authority and document lifetime](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/extension-message-boundaries.html) — Trace real page messages into extension capabilities and test sender identity, navigation races, permission changes and worker restarts.

## Vulnerability reference

- [Broken object-level authorization (BOLA / IDOR)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bola-controlled-object-access.html)
- [Broken function-level authorization (BFLA)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bfla-restricted-function.html)
- [Broken property authorization: private response fields](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/bopla-private-response-property.html)
- [Mass assignment of server-controlled properties](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/mass-assignment-protected-property.html)
- [Authentication or MFA state bypass](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/authentication-incomplete-state-bypass.html)
- [Session fixation across login](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/session-fixation-login-binding.html)
- [Residual access after explicit session revocation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/session-revocation-residual-access.html)
- [Password reset binding or single-use failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/password-reset-account-binding.html)
- [OAuth login or account-linking confusion](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/oauth-login-account-linking-confusion.html)
- [JWT signature, issuer, audience, or token-purpose validation failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/jwt-signature-trust-failure.html)
- [SQL injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/sql-query-structure-injection.html)
- [NoSQL operator or query injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/nosql-operator-contract-bypass.html)
- [OS command injection](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/os-command-argument-boundary.html)
- [Server-side template injection (SSTI)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/server-template-expression-injection.html)
- [Reflected or stored cross-site scripting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xss-reflected-stored-origin-execution.html)
- [DOM-based cross-site scripting](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/dom-xss-source-sink-flow.html)
- [Cross-site request forgery (CSRF)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/csrf-browser-forged-state-change.html)
- [CORS private-data exposure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cors-private-credentialed-read.html)
- [Cross-origin messaging trust failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/postmessage-origin-validation.html)
- [Server-side request forgery (SSRF)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ssrf-forbidden-destination.html)
- [Unsafe upload interpretation or placement](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-upload-interpretation.html)
- [Path traversal outside an allowed root](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/path-traversal-controlled-canary.html)
- [XML external entity injection (XXE)](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/xxe-external-entity-resolution.html)
- [Archive extraction path escape](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/archive-extraction-path-escape.html)
- [Race condition in a security-sensitive transition](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/race-condition-duplicate-transition.html)
- [Workflow order or approval bypass](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/workflow-order-validation-bypass.html)
- [Single-use action or idempotency replay failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/single-use-idempotency-replay.html)
- [GraphQL resolver or field authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/graphql-resolver-field-authz.html)
- [WebSocket message or subscription authorization failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/websocket-message-authorization.html)
- [Cross-site WebSocket hijacking](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/cross-site-websocket-hijacking.html)
- [Hard-coded product credentials](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/hardcoded-credentials.html)
- [CI artifact poisoning across a workflow trust boundary](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/ci-artifact-poisoning.html)
- [Dependency confusion and unintended package origin](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/dependency-confusion.html)
- [Unsafe object deserialization](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/unsafe-deserialization.html)
- [JavaScript prototype pollution](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/prototype-pollution.html)
- [Out-of-bounds memory read](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-read.html)
- [Out-of-bounds memory write](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/out-of-bounds-write.html)
- [Use after free in a public API or parser lifecycle](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/use-after-free.html)
- [Integer overflow affecting allocation or bounds](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/integer-overflow.html)
- [Parser resource exhaustion and decompression amplification](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/parser-resource-exhaustion.html)
- [Regular-expression denial of service](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/regex-dos.html)
- [Predictable temporary files and unsafe creation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/insecure-temporary-files.html)
- [Untrusted executable, library, or module search path](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/untrusted-search-path.html)
- [Local authentication does not gate the protected operation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-local-auth-gate.html)
- [Backup or transfer exposes unintended sensitive client state](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-backup-sensitive-state.html)
- [Sensitive client state leaks through accessible diagnostics](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-secret-logging.html)
- [TLS peer certificate or hostname verification failure](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-invalid-certificate.html)
- [Electron IPC exposes main-process authority to an untrusted sender](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/electron-ipc-confused-deputy.html)
- [Desktop protocol handler misinterprets external input](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/desktop-protocol-confusion.html)
- [Updater accepts an artifact outside its publisher trust policy](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/update-untrusted-artifact.html)
- [Privileged updater consumes lower-user-controlled staging content](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/updater-privileged-staging.html)
- [Attacker-controlled rollback restores a prohibited security state](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/update-security-rollback.html)
- [Predictable security token or capability identifier](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/weak-security-token-randomness.html)
- [Password storage without an adequate adaptive hash](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/password-storage-weak-hash.html)
- [Encrypted data accepted without integrity authentication](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/crypto-authentication-missing.html)
- [Unauthorized authenticator enrollment, replacement, or removal](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/authenticator-management-proof-bypass.html)
- [WebAuthn assertion accepted for an invalid account or ceremony context](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/webauthn-assertion-binding-failure.html)
- [Verification or account merge preserves another actor's access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/identity-verification-merge-confusion.html)
- [Enforced SSO bypass through an alternate login path](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/enforced-sso-alternate-login-bypass.html)
- [Argument or option injection without shell interpretation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/process-argument-option-injection.html)
- [Page message borrows unintended browser-extension authority](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/extension-message-authority.html)
- [Delayed extension result reaches a different document](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/extension-document-reply-confusion.html)
- [Private client content leaks through a lower-trust display or sharing channel](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities/client-private-ui-disclosure.html)