# Electron IPC exposes main-process authority to an untrusted sender

An attacker-controlled renderer or frame invokes a privileged main-process operation through insufficient sender or argument validation.

**Candidate CWE:** [CWE-749](https://cwe.mitre.org/data/definitions/749.html) · [CWE-863](https://cwe.mitre.org/data/definitions/863.html)

## Test hypothesis

Trace a legitimate bridge call, then repeat it from an untrusted context reachable through a real feature; compare rejected sender and invalid-argument controls.

## Evidence required

Actual frame/origin, entry path, exposed bridge, IPC handler, argument constraints and one bounded native read/write result.

## Rule out false positives

Context isolation enabled is not a complete defense, but its absence alone is not a finding. Console-only execution does not establish an attacker entry.

## Playbook and command references

- [Desktop IPC, Electron bridges and native protocols](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/desktop-ipc.html) — Follow page, file and local-process inputs into privileged desktop capabilities with a realistic caller.
- [Browser execution, cross-origin reads, and forged actions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/browser-trust.html) — Use real browser behavior to distinguish XSS, CSRF, CORS, and messaging failures from header-only leads.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Desktop%20IPC%2C%20Electron%20bridges%20and%20native%20protocols)

## Referenced by these target playbooks

[Desktop & extensions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

- [T1203 · Exploitation for Client Execution](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html#T1203) — **Only if:** A client-application vulnerability executes attacker-controlled code when the client processes a file, document, or other content; identify the affected desktop/client process. **Not established by:** A parser crash alone is insufficient. Ordinary web XSS is not automatically a native client execution exploit, and Mobile uses separate technique IDs.

## Primary references

- [Electron IPC sender validation](https://www.electronjs.org/docs/latest/tutorial/security)
- [Electron context isolation](https://www.electronjs.org/docs/latest/tutorial/context-isolation)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)