# Diving Into Electron Web API Permissions

Electron auto-approves web API permission requests by default, letting a compromised renderer read clipboard, capture media, and fingerprint fonts without user interaction.

- Payout: Research
- Severity: medium
- Program: Electron
- Write-up by: Doyensec
- Disclosed: 2022-09-26
- Write-up quality: 6/10
- Original: https://blog.doyensec.com/2022/09/27/electron-api-default-permissions.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2022-09-27-electron-api-default-permissions-html
- Tags: area:os domain:desktop impact:data-leak impact:pii-leak kind:research platform:research sev:medium tech:electron technique:source-review vuln:access-control vuln:info-disclosure

**Target:** Electron renderer permission API (clipboard, media, notifications, idle-detection, fonts)
**Root cause:** Electron's permission API auto-approves all permission requests unless the developer configures a custom setPermissionRequestHandler, unlike Chrome which prompts and gates on user gesture.
**Steps:**
1. Compromise the renderer process via XSS or unsafe navigation (open redirect, clicking links).
2. Without any permission handler, call `navigator.clipboard.readText()`; add a `window` load event handler to read the clipboard without user interaction.
3. Call `navigator.mediaDevices.getUserMedia()` for the grouped "media" permission to access webcam/microphone.
4. Call `navigator.mediaDevices.enumerateDevices()` to fingerprint all media devices even under a deny-all handler.
5. Use the File System Access API picker to grant read access to root or sensitive directories with no notification.
6. Read local fonts via the Local Font Access API; no permission request reaches the main process.
**How found:** Compared Electron's permission implementation against Chrome's prompt-and-gesture model, then tested each web API (clipboard, media, file system, fonts) to see what a renderer gets by default; noticed a load event handler bypassed the clipboard user-gesture requirement.
**Exploitation:** A compromised renderer (XSS or navigation to attacker origin) abuses default-approved permissions to silently read clipboard contents, capture webcam/microphone, send phishing notifications, and fingerprint devices/fonts, all without user prompts.
**Insight:** Electron's permission API diverges from Chrome: it groups media permissions and skips gesture/origin checks, so test each web API individually under a deny-all handler to find what still leaks (e.g. enumerateDevices and fonts bypass handlers entirely).