Desktop IPC, Electron bridges and native protocols

Follow page, file and local-process inputs into privileged desktop capabilities with a realistic caller.

Used in these playbooks#

Setup and invariant#

Prepare a disposable desktop VM or owned Mac, a standard-user account, a clean application profile and synthetic files in a dedicated lab directory. Record release, Electron/runtime version when present, OS and installation mode. Capture the normal process tree: renderer, preload, main process, extension service worker, native host, helper or service.

Invariant: a lower-trust caller gets only explicitly authorized operations with constrained arguments. A local listener, broad preload API, or privileged process becomes actionable when a realistic caller can reach a sensitive capability. Console execution manually injected into a trusted renderer does not establish that route.

Procedure and command sheet#

1. Inventory actual handlers. In local source or extracted JavaScript, locate windows, preload APIs, IPC registrations and protocol handlers. These are read-only searches:

rg -n 'ipcMain\.(handle|on)|contextBridge|nodeIntegration|contextIsolation|sandbox' ./source
rg -n 'openExternal|setAsDefaultProtocolClient|open-url|second-instance|protocol\.handle' ./source
rg -n 'connectNative|sendNativeMessage|allowed_origins|externally_connectable' ./extension

For each hit record input origin, current process identity, argument schema, authorization check, and final file/shell/helper operation. Include auxiliary windows rather than assuming the main window's settings apply everywhere.

2. Capture a valid transaction. Open an intended file or settings panel and trace one documented bridge method. Record sender frame/origin, method, arguments, and result. Electron recommends validating IPC senders, including relevant frame identity; navigation can change which document is using a renderer. Electron security.

3. Change one trust condition. Exercise the same method from an attacker-controlled page/frame reachable through an actual app feature, or from an ordinary local client for a native IPC endpoint. Compare with the trusted baseline and a disallowed method/argument. Keep the proof to reading a seeded nonsensitive file or writing one marker in the test directory. contextIsolation does not repair an overbroad bridge; inspect the capability exposed and the main-process checks. Context isolation.

4. Trace external protocols. Invoke a discovered handler through the OS-supported route with a harmless synthetic URI. On macOS, after verifying the registered scheme:

open 'labapp://open?item=BB-DESKTOP-01'

Record URI parsing and argument construction before reaching native functionality. Compare a normal item with a malformed/unknown item; the latter should be rejected without launching unintended functionality. Test packaged behavior because protocol registration differs by OS and packaging. Never infer command execution merely from shell.openExternal being present. Electron deep links, Shell API.

5. Extend into native hosts. For a browser extension, inspect native-host allowed_origins, executable path, message schema and downstream arguments. An allowed extension still needs to constrain untrusted page messages it forwards. A native host invocation has the user's process privileges unless another actual boundary is shown. Chrome native messaging.

Evidence, reuse and cleanup#

Preserve the complete sequence from realistic entry point to capability, with sender identity, target identity, exact input, expected denial and result. Reuse browser trust for origin/navigation validation, file boundaries for path handling and authorization matrix for action ownership. Backend token effects belong to identity/session.

• Reproduce from a reachable untrusted context, without developer-console privilege.
• Separate same-user capability abuse from administrator/system escalation.
• Compare valid sender, untrusted sender, and invalid arguments.
• Remove test protocol registrations if created, close local clients, delete marker fixtures and restore the clean profile/snapshot.

Extension-specific continuation#

For page forwarding, browser-supplied sender metadata, navigation races, worker restarts and optional permission changes, run extension message boundaries. Return here only when the verified path crosses into a native host, local protocol or privileged helper. Preserve the same originating page and owned synthetic marker across both procedures.

Vulnerability reverse references#

• Electron IPC exposes main-process authority to an untrusted sender — An attacker-controlled renderer or frame invokes a privileged main-process operation through insufficient sender or argument validation.
• Desktop protocol handler misinterprets external input — An OS-dispatched URL reaches a native command or operation with attacker-controlled arguments outside the intended handler contract.
• Page message borrows unintended browser-extension authority — An ordinary web page reaches a privileged extension action through insufficient message sender or argument validation.

Nearby shared procedures#

Object, function, and property authorization · Authentication, recovery, federation, and session lifecycle · Trace input into queries, commands, and templates · Server-side fetching and network trust boundaries · Browser execution, cross-origin reads, and forged actions · Uploads, downloads, paths, archives, and XML · Workflow invariants, replay, idempotency, and races · REST, GraphQL, gRPC, WebSocket, and SSE permission parity