auditing-electron-ipc-trust

Auditing Electron IPC trust: when renderer content reaches a native capability

An Electron app is dangerous where content in a renderer, whether remote, injected through a cross-site-scripting, or arriving over a custom protocol, reaches a Node or operating-system capability. The marquee chain is a renderer bug escalating to code execution because the renderer can require Node directly, or because the preload bridge hands untrusted input to a native call. You audit it by resolving, per native sink, whether context isolation and the sandbox stand between the renderer and Node and whether the preload and IPC surface validate what they pass. The single most important false-positive killer is that context isolation and the sandbox being on make an otherwise alarming exposed symbol harmless, so resolve those two settings before judging any bridge. Renderer-side markup injection itself belongs to the client-side DOM skill; this skill owns the bridge and the IPC substrate.

When to use

• You are reviewing an Electron app's window configuration, its preload scripts, and its IPC handlers.
• You see webPreferences, a contextBridge exposure, an ipcMain handler, or a loadURL or openExternal call.
• You want to know whether untrusted renderer content can reach a Node or operating-system capability.

Scope check

Audit only apps you own or are authorized to assess, and drive a renderer-to-main path only against a build in scope, an IPC handler that reaches a shell or the filesystem acts on your host. Adjudicate on the window configuration and the handlers. If you can't name the authorization, stop.

The loop

1. Resolve context isolation and the sandbox first. Read the webPreferences for each window: is nodeIntegration off, is contextIsolation on, is the sandbox on. These settings decide whether the renderer can reach Node at all, so an exposed require or a Node symbol is only exploitable when they are off. Settle them before judging any exposed surface, because they are the killer for most leads.