# Modern Alchemy: Turning XSS into RCE

Electron's BrowserWindowProxy SOP bypass plus privileged chrome-devtools:// URL let XSS override nodeIntegration and achieve RCE in any Electron app before 1.6.8.

- Payout: Research
- Severity: high
- Program: Electron
- Credited: Doyensec
- Disclosed: 2017-08-02
- CVE: CVE-2017-12581
- Write-up quality: 8/10
- Original: https://blog.doyensec.com/2017/08/03/electron-framework-security.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html
- Tags: domain:desktop impact:rce kind:research platform:research sev:high tech:chromium tech:electron technique:chained technique:source-review vuln:auth-bypass vuln:rce

**Target:** Electron renderer / BrowserWindowProxy and privileged chrome-devtools:// URL
**Root cause:** Electron's window.open returns a BrowserWindowProxy that lets the opener eval() into the child window, subverting SOP; combined with the privileged chrome-devtools://devtools/bundled/inspector.html URL, the eval runs with Node integration despite nodeIntegration:false.
**Steps:**
1. Open a child window to a privileged URL: `const win = window.open("chrome-devtools://devtools/bundled/inspector.html")`
2. Use the BrowserWindowProxy to eval into it: `win.eval("const {shell} = require('electron'); shell.openExternal('file:///Applications/Calculator.app');")`
3. Observe Calculator launch, proving Node access in the renderer despite nodeIntegration:false
**How found:** Studied all prior nodeIntegration bypass fixes (6 before v1.6.1) to learn the design, then read docs and noticed BrowserWindowProxy deviates from standard browsers by allowing cross-origin manipulation; source review of lib/renderer/init.js revealed privileged URLs, which were combined with the SOP bypass.
**Exploitation:** Attacker needs only to render untrusted content (e.g. via XSS) in an Electron app with nodeIntegration disabled. The page opens the privileged chrome-devtools:// inspector URL, then uses win.eval to execute Node code in that privileged context, escaping the sandbox and running OS commands via require('electron').shell.
**Escalation:** Turns a standard web XSS into full host RCE across all Electron-based desktop apps prior to 1.6.8.
**Insight:** When a framework reimplements window.open/eval semantics, check whether the opener can eval into a child window; then grep the framework source for privileged URL schemes (chrome-devtools://, chrome://) that grant elevated context and chain them.