# Desktop protocol handler misinterprets external input

An OS-dispatched URL reaches a native command or operation with attacker-controlled arguments outside the intended handler contract.

**Candidate CWE:** [CWE-88](https://cwe.mitre.org/data/definitions/88.html)

## Test hypothesis

Invoke a harmless discovered scheme normally, then vary one encoded argument in a local fixture and observe parsing and the eventual operation.

## Evidence required

Packaged application/OS, registered scheme, exact URI, argument construction, required interaction and protected effect.

## Rule out false positives

Protocol registration and opening a legitimate application are expected. Do not label parsing errors as command execution without a verified command boundary.

## Playbook and command references

- [Desktop IPC, Electron bridges and native protocols](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/desktop-ipc.html) — Follow page, file and local-process inputs into privileged desktop capabilities with a realistic caller.
- [Uploads, downloads, paths, archives, and XML](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/file-boundaries.html) — Follow a file through acceptance, storage, processing, publication, and retrieval while preserving ownership and path boundaries.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Desktop%20IPC%2C%20Electron%20bridges%20and%20native%20protocols)

## Referenced by these target playbooks

[Desktop & extensions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

- [T1203 · Exploitation for Client Execution](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html#T1203) — **Only if:** A client-application vulnerability executes attacker-controlled code when the client processes a file, document, or other content; identify the affected desktop/client process. **Not established by:** A parser crash alone is insufficient. Ordinary web XSS is not automatically a native client execution exploit, and Mobile uses separate technique IDs.

## Primary references

- [Electron deep links](https://www.electronjs.org/docs/latest/tutorial/launch-app-from-url-in-another-app)
- [Electron shell API](https://www.electronjs.org/docs/latest/api/shell)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)